LootBot.xyz staking contract exploited for $9,600 via logic error allowing duplicate NFT IDs to be redeemed multiple times in a single call.
Security & Exploits ·
LootBot's staking contract suffered a $9,600 loss on April 15 due to a logic error in its redemption mechanism. The redeem() function failed to validate duplicate xLoot NFT IDs within a single call, allowing the same NFT identifier to be processed multiple times and accumulate rewards repeatedly. The vulnerable code updated the nextRedeem mapping only after calculating and distributing rewards, meaning an attacker could submit a single NFT ID 155 times in one transaction to receive 155x the legitimate payout.
The exploit unfolded through a flash-loan vector. An attacker borrowed 2.1 ETH from Balancer and deposited it into the staking contract to trigger a new reward epoch, then invoked redeem() with seven xLoot NFT IDs, each duplicated approximately 155 times, extracting roughly 6.21 ETH from the contract. After repaying the flash loan, the attacker retained a net profit of approximately 4.1 ETH.
The vulnerability sits in the _redeemable() function's iteration logic, which accumulates per-epoch rewards without checking whether an ID has already been processed in the same call. No patched contract version, remediation timeline, or statement from the project has been reported.