Security Incident · ETH Ecosystem
X7 Finance Smart Contract Vulnerability: $16.51K Reported Loss
An attacker exploited an accounting bug in X7Pioneer’s claimRewards().
- Reported loss
- $ 16,514
- Attack category
- Smart Contract Vulnerability
Incident Overview
The function adds address(this).balance - lastETHBalance to totalRewards on every call, but updates lastETHBalance only when claimable > 0. An empty array leaves claimable at 0, so the same unaccounted balance is added repeatedly and inflates per-token rewards. The attacker donated ETH to widen the delta, then drained about 6.78 ETH.
Sources & References
This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.