RisingSun token locker exploited for $1,525 via uncleared lock entries allowing double-withdrawal of locked funds.
Security & Exploits ·
An exploit in the RisingSun token locker (RSunTokenLocker) on the Binance Smart Chain resulted in a loss of 1,525 BUSD on March 14, 2026. The attacker executed a double-withdrawal attack by flash-loaning the funds, creating a zero-duration lock, and calling the withdrawTokens() function twice on the same lock entry to drain the contract's holdings.
The vulnerability stems from a logic error in state management. The withdrawTokens() function failed to fully clear lock entries after withdrawal—while it removed the owner index via removeLockOwnership(), the lock data including owner and amount fields remained in storage. This allowed the same lock to be withdrawn from multiple times. The attack pattern mirrors an earlier vulnerability found in DX.app, where similar state invalidation gaps were exploited.
The affected locker contract held funds on behalf of multiple users. The transaction details and victim address are visible on BSCScan, though the full scope of impact on other depositors remains unclear from available information.