Royal.io's royalty contract exploited for $261K USDC via flash loan attack abusing pro-rata accounting logic on Polygon.
Security & Exploits ·
Royal.io's royalty distribution contract on Polygon suffered an exploit on June 23, 2026, resulting in a loss of approximately $261,000 in USDC. An attacker used a flash loan to artificially inflate their tier-42 balance in the contract, achieving roughly 100× pro-rata ownership, then deposited approximately 2,638 USDC in royalties before withdrawing approximately 263,808 USDC through the claim function—a 100× return on the deposit.
The vulnerability lay in Royal's royalty accounting logic, which calculates payouts by multiplying deposits by the ratio of an account's tier balance to the total tier supply. The _settleUcr() function failed to cap ownership to 100 percent, allowing the inflated balance to drain the royalty pool without constraint. The attacker repaid the flash loan and retained the remaining USDC difference.
The attack exposed a critical flaw in the pro-rata distribution mechanism: the contract did not validate that a user's fractional ownership remained within reasonable bounds before processing claims. It remains unclear whether additional safeguards have been implemented or whether other contracts using similar accounting patterns face comparable risk.