Leaderboard
619All-time rank
Level Perps
May 1, 2023
$1.1M
Lost
$1.1M
Recovered
$0
Net loss
$1.1M
Unrecovered0% recovered
1M in May 2023 when attackers exploited missing epoch reuse prevention in the referral claims contract. Flashloans inflated reward tiers, allowing multiple claims per epoch via the unprotected claimMultiple() function.
How the exploit worked
View reproducible PoCBusiness Logic Flaw.
Lost: ~$1M
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Reward Logic Flaw
- Attribution
- Unknown
- Chains
BSC
Event timeline
- May 1, 2023Exploit executed — $1.1M drained via reward logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)