Leaderboard
425All-time rank
P
Polkatrain
Apr 5, 2021
$3.0M
Lost
$3.0M
Recovered
$0
Net loss
$3.0M
Unrecovered0% recovered
The POLT_LBP contract's rebate mechanism lacked maximum rebate limits or exhaustion checks. An attacker repeatedly called the swap function to extract rebate rewards, draining 57K DOT (~$3M) from the contract.
The contract's _update function failed to validate rebate constraints.
- Target
- DeFi
- Classification
- Protocol Logic
- Technique
- Reward Logic Flaw
- Attribution
- Unknown
- Chains
Polkadot
Event timeline
- Apr 5, 2021Exploit executed — $3.0M drained via reward logic flaw
- Attributed to Unknown
- Recovery status Unrecovered 0%