Leaderboard
1223All-time rank
LunaFi
May 23, 2023
$35K
Lost
$35K
Recovered
$0
Net loss
$35K
Unrecovered0% recovered
LunaFi's reward claiming mechanism lacked a time lock in the claimRewards() function, allowing an attacker to repeatedly claim rewards using a malicious contract. The vulnerability enabled depositing, claiming, and withdrawing within a single transaction, generating profits while depleting the reward pool.
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Reward Logic Flaw
- Attribution
- Unknown
- Chains
Polygon
Event timeline
- May 23, 2023Exploit executed — $35K drained via reward logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%