🚨 EXPLOIT ALERT: $35k Drained from @DoinGudHQ
Classic reentrancy-style bug in acceptOffer function. Here's the alpha:
The Flaw:
• Implementation 0x123aaf... transfers $USDC to msg.sender but NEVER deletes the offer record
• Missing checks: no offerer != msg.sender guard, no offerAmount > 0 requirement
• Result? Same offer replayed infinitely with identical calldata
The Damage:
• Attacker (0xb8c717...) drained 70,973 $USDC in ONE tx via flash loan
• Replayed acceptOffer twice, walked away with ~$35k profit
• Zero NFTs transferred, zero principal at risk
Victim contract: 0xe3a161...
Attacker: 0xb8c717... / 0xe588834...
Lesson: Always zero out state after transfers. Swap-and-pop logic from cancelOffer was completely absent here. Classic DeFi footgun.
SlowMist caught it. Stay safe out there.
Classic reentrancy-style bug in acceptOffer function. Here's the alpha:
The Flaw:
• Implementation 0x123aaf... transfers $USDC to msg.sender but NEVER deletes the offer record
• Missing checks: no offerer != msg.sender guard, no offerAmount > 0 requirement
• Result? Same offer replayed infinitely with identical calldata
The Damage:
• Attacker (0xb8c717...) drained 70,973 $USDC in ONE tx via flash loan
• Replayed acceptOffer twice, walked away with ~$35k profit
• Zero NFTs transferred, zero principal at risk
Victim contract: 0xe3a161...
Attacker: 0xb8c717... / 0xe588834...
Lesson: Always zero out state after transfers. Swap-and-pop logic from cancelOffer was completely absent here. Classic DeFi footgun.
SlowMist caught it. Stay safe out there.