GoPlus: ListaDAO's liquidity staking vault was attacked, and the attacker exploited a logical vulnerability to steal funds

GoPlus Security released an analysis stating that the Liquid Staking Vault contract of ListaDAO was attacked due to a business logic flaw. The attacker triggered the share calculation function of the Dividend contract when transferring specific tokens, which affected the reward distribution logic of the staking vault, ultimately stealing a large amount of assets from the contract.

GoPlus Security reminds that this logical vulnerability exists in both the Liquid Staking Vault and Dividend contracts, and any fork or reused implementation carries a high risk of being exploited. Developers and projects are strongly advised to conduct reviews and fix the vulnerabilities accordingly. Smart contract security should not rely on "one-time audits."

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.