🚨 EXPLOIT ALERT 🚨

@X7_Finance just got drained for ~6.78 $ETH

The Bug:
Reward accounting logic broken in claimRewards(). totalRewards increments by (balance - lastETHBalance) every call, but lastETHBalance only updates when claimable > 0.

The Attack:
→ Call with empty array (claimable stays 0)
→ Same unaccounted balance gets added to totalRewards repeatedly
→ Per-token reward inflates artificially
→ Attacker donates ETH to pump the delta
→ Drains contract

Classic reward inflation vuln. Always update state variables consistently.

Attacker: 0xc79352119a7cf6efbfabbd7e6b013b79687bacf2
Victim Contract: 0x70000299ee8910ccacd97b1bb560e34f49c9e4f7

Stay safe out there 🛡️