Pandora DAO Price Manipulation

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Pandora DAO Logo/Homepage Recreation

The Pandora Chain DAO claimed to be launched by students at various well-known universities and promised a high-efficiency and energy-saving public chain for developers with an impressive website and slide deck. Despite their smart contract being audited, it was drained of $128k USD via a price manipulation exploit on June 22nd, 2022. It is unclear if any compensation was made to investors, and the website is presently offline and the team does not appear to have updated their Twitter since before the incident.

This is a global/international case not involving a specific country.

About Pandora DAO

"Decentralized high-efficiency and energy-saving public chain for developers"

"Every job you do will benefit you for life."

"Any enterprise or company can use decentralized autonomy to keep running smoothly."

"In the future, companies will no longer exist, and all economic activities will benefit from a new decentralized and autonomous organizational model of co-governance for life."

"All this is becoming a reality."

"A group of blockchain spiritual geeks from various well-known universities, determined to rely on the shib consensus and the concept of creating a new production relationship in human society, to create a new public chain that is subversive in the times, fully open source and decentralized community autonomy - PANDORA Chain DAO. Make Decentralized Autonomous Organization (DAO) a reality."

"Try to record everyone's efforts and services on the blockchain in an immutable way and save them forever. The value and results contributed by each person are in the DAO, benefiting a lifetime token. This is a new incentive method, a brand-new organizational form, and will surely become an organizational model of new production relations that promotes future social development. Let us create the ideal planet of PANDORA together."

"The PANDORA Chain DAO project was initiated by a group of students who believe in freedom and autonomy. It aims to establish a public chain that operates decentralized and autonomously under completely open, fair and just rules."

"PCD is the only token of the PANDORA Chain DAQ public chain. Everything is built on smart contracts, and all open source (reviewable) codes are reviewed by well-known auditing agencies."

"The initial issue price of the DAO Foundation smart contract is a constant 1.3 million shib. The contract shib can only be exchanged for the equivalent shib by destroying the PCD. It is impossible for any third party to use the funds of the DAO contract"

"There are no public offerings, private placements, airdrops, and genesis circulation for PCD tokens. The generation of all PCD tokens is based on the issuance of smart contracts based on global mutual assistance and autonomy."

"Ideal of CO sponsors (developers): make decentralized autonomous organization (DAO) a reality, try to record everyone's efforts and services on the blockchain in an tamper proof way, and permanently save < br > the value and achievements contributed by everyone in the Dao, It is a new incentive method, a new decentralized and highly autonomous organizational form, and will also become an organizational model of new production relations to promote the development of society in the future"

"This team will run their second #presale at 15:00 on May 19 and aim to provide the daily return of 10%"

"Beosin EagleEye monitored that @pandorachainDAO $PCD was under a flashloan price manipulation attack, with a loss of 128,222 $USDT. The stolen funds currently stay at the hacker's address."

"PandoraDAO was hacked for 128,222 $USDT. The hacker manipulated the $PCD price through flashloan to get a large amount of PCD locked tokens, then unlocked the PCD tokens multiple times and swapped for $USDT."

"Step 1: Prepare for price manipulation by flashloaning a large amount of $USDT from the USDT-PCD contract."

"Step 2: Call the shouchan function in the PCDNFT contract and swap 126 $USDT for 869,241,168,220 PCDs to lock up the position."

"As the shouchan function gets the price of $PCD by calculating the balance of the current tokens in the USDT-PCD contract, the PCD price reaches an extremely low value after step 1, and the hacker can exchange a small amount of $USDT for a large amount of $PCD locked tokens."

"Step 3: Unlock the PCD tokens and swap them for USDT."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Pandora DAO Price Manipulation

Date	Event	Description
March 25th, 2022 4:14:35 PM MDT	Pandora DAO Website	The first capture of the Pandora DAO website is taken. This features a large countdown timer for the launch of the DAO.
May 12th, 2022 1:08:00 AM MDT	Until It Is Robbed	Pandora DAO posts a cryptic tweet ironically alluding to the possibility of being robbed. "On May 15, 2022, the quota of defi-pcd IDO is 100, until it is robbed. The last 900 will all need to build a community review white list."
May 16th, 2022 3:38:55 AM MDT	Last Capture Date	The last time the Pandora DAO website was captured. The domain is presently offline.
May 16th, 2022 4:18:00 AM MDT	Airdrop Tweet	Despite promising no airdrop in their whitepaper, the team promotes a tweet with "Top 100 airdrop 1000 PCD per address" to announce the second presale.
June 4th, 2022 9:38:00 PM MDT	Launch Data Announcement	The launch of the blockchain is announced on Twitter.
June 22nd, 2022 3:42:46 AM MDT	Blockchain Transaction	The exact time of the malicious blockchain transaction.
June 22nd, 2022 4:31:00 AM MDT	User Accusations	A user posts on Twitter to accuse the project of being a rug pull.
June 22nd, 2022 5:25:00 AM MDT	Beosin Alert Tweet 1	Beosin tweets an initial tweet about detecting the smart contract exploit.
June 22nd, 2022 6:14:00 AM MDT	Beosin Alert Tweet 2	Beosin tweets another tweet with a technical analysis of the attack. They confirm the hack was successful and the total amount which was taken from the Pandora DAO.
June 22nd, 2022 9:17:00 AM MDT	CertiK Tweet	CertiK shares a basic tweet about the smart contract exploit.
September 13th, 2022 9:21:00 AM MDT	Another Exploit	The same attacker is found to exploit another smart contract for the Sad Token.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost has been estimated at $128,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

No specific policies for individual prevention have yet been identified in this case.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.