Dream Health Chain

createAward() recorded a reward without reserving collateral for that award, while participateAward() allowed an already claimed award (status=2) to be reset to claimable (status=1). The attacker repeatedly reset and reclaimed awards for as little as a 0–1 wei transfer, draining funds from the contract’s shared proxy balance.