DoinGud
Sep 21, 2026
DoinGud’s acceptOffer settlement logic transferred an offer’s USDC price to the caller without deleting or zeroing the consumed offer record. Unlike cancelOffer, the acceptance path omitted the swap-and-pop cleanup.
Missing checks also permitted the offerer to accept their own offer and permitted a zero NFT amount. By using amount=0, the attacker avoided listing cleanup and replayed identical acceptOffer calldata, causing the contract to pay the same offer repeatedly.
A flash loan supplied the temporary USDC needed to construct the self-funded offer. Independent reporting likewise describes the exploit as failure to clear a bid after acceptance.
How the exploit worked
View reproducible PoCacceptOffer replay via missing offer cleanup on the amount=0 path.
Lost: 35,380.154566 USDC net (two byte-identical acceptOffer calls each paid out 35,486.935717 USDC from escrow; funded via a UniV2 flash swap, repaid 35,593.71686…
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- Other
- Classification
- Protocol Logic
- Technique
- Swap Logic Flaw
- Attribution
- Unknown
- Chains
Event timeline
- Sep 21, 2026Exploit executed — $35K drained via swap logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)