🚨 EXPLOIT ALERT 🚨
@X7_Finance just got drained for ~6.78 $ETH
The Bug:
Reward accounting logic broken in claimRewards(). totalRewards increments by (balance - lastETHBalance) every call, but lastETHBalance only updates when claimable > 0.
The Attack:
→ Call with empty array (claimable stays 0)
→ Same unaccounted balance gets added to totalRewards repeatedly
→ Per-token reward inflates artificially
→ Attacker donates ETH to pump the delta
→ Drains contract
Classic reward inflation vuln. Always update state variables consistently.
Attacker: 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2
Victim Contract: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7
Stay safe out there 🛡️
@X7_Finance just got drained for ~6.78 $ETH
The Bug:
Reward accounting logic broken in claimRewards(). totalRewards increments by (balance - lastETHBalance) every call, but lastETHBalance only updates when claimable > 0.
The Attack:
→ Call with empty array (claimable stays 0)
→ Same unaccounted balance gets added to totalRewards repeatedly
→ Per-token reward inflates artificially
→ Attacker donates ETH to pump the delta
→ Drains contract
Classic reward inflation vuln. Always update state variables consistently.
Attacker: 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2
Victim Contract: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7
Stay safe out there 🛡️