🚨 $DHC Dream Health Chain drained for ~$71.8k

Classic state machine exploit:
→ createAward() sets fixed reward, zero collateral lock
→ participateAward() lets you reset a CLAIMED award (status=2 → 1)
→ claimAward() pays out again from shared proxy balance
→ Rinse. Repeat. Cost to trigger? 0–1 wei.

Attacker: 0xd3a8...2b07
Victim Proxy: 0xe2a0...2094
Exploit Contract: 0x2269...968a

Another day, another unaudited reward contract rekt. If your protocol has "award logic" without per-claim reserves or status locks, you're next.