🚨 $DHC Dream Health Chain drained for ~$71.8k
Classic state machine exploit:
→ createAward() sets fixed reward, zero collateral lock
→ participateAward() lets you reset a CLAIMED award (status=2 → 1)
→ claimAward() pays out again from shared proxy balance
→ Rinse. Repeat. Cost to trigger? 0–1 wei.
Attacker: 0xd3a8...2b07
Victim Proxy: 0xe2a0...2094
Exploit Contract: 0x2269...968a
Another day, another unaudited reward contract rekt. If your protocol has "award logic" without per-claim reserves or status locks, you're next.
Classic state machine exploit:
→ createAward() sets fixed reward, zero collateral lock
→ participateAward() lets you reset a CLAIMED award (status=2 → 1)
→ claimAward() pays out again from shared proxy balance
→ Rinse. Repeat. Cost to trigger? 0–1 wei.
Attacker: 0xd3a8...2b07
Victim Proxy: 0xe2a0...2094
Exploit Contract: 0x2269...968a
Another day, another unaudited reward contract rekt. If your protocol has "award logic" without per-claim reserves or status locks, you're next.