DHC Award vault — claimed reward can be reset and paid again from the shared pool

Source & credit. Exploit reproduction, trace data, and analysis adapted from DeFiHackLabs by SunWeb3Sec — an open registry of reproduced on-chain exploits. Standalone Foundry PoC and full write-up: 2026-09-DHC_exp in the evm-hack-registry mirror. Upstream DeFiHackLabs PoC: src/test/…/DHC_exp.sol.

Vulnerability classes: vuln/logic/incorrect-state-transition · vuln/logic/reward-calculation · vuln/logic/missing-check

Reproduction: the PoC compiles & runs in an isolated Foundry project at this project folder. Full verbose trace: output.txt. Source test: test/DHC_exp.sol.

Key info#

TL;DR#

DHC (DeHealth / RedSonic-style "Award" staking) records a fixed reward in createAward with no per-award locked collateral. participateAward does not require the award to still be unclaimed: a claimed award (status 2) can be reset to status 1 by anyone who owns the position, for as little as 0–2 wei. claimAward then pays the same fixed reward again out of the shared proxy DHC balance.

The live attack was four txs in one block: deploy + prime + pledge + cashout. This PoC keeps that shape as typed calls (selectors inferred from the trace; impl is unverified):

1. prime: buy DHC with 10k USDT (flash-loan stand-in), setInviter, createAward(fixed reward).
2. pledge: participateAward full amount, claimAward once (status → 2).
3. cashout: loop { participateAward(id, 2 wei); claimAward(id); } until the proxy cannot cover another reward, dump DHC→USDT, repay 10k, keep the surplus.

Net ~71.1k USDT in the reconstruction (on-chain 71,851 USDT).

Background#

The award vault is a TransparentUpgradeableProxy. Implementation 0x5abb3fe2… is not verified; none of the four award selectors resolve in 4byte. Behaviour is reconstructed from the trace (argument layout, token movements, status transitions):

setInviter lives on the DHC token; participate reverts on a zero inviter. The attacker chained off an already-registered root 0xe099…FA60.

The USDT flash loan is not the vulnerability; the PoC deals 10,000 USDT.

The vulnerable code#

RECONSTRUCTED from trace (impl unverified):

// createAward records reward R with no locked backing.
// claimAward pays a fixed fraction of R from IERC20(DHC).balanceOf(proxy)
//   and sets status = 2 (claimed).
// participateAward(id, amount):
//   does NOT require status != 2
//   amount can be dust (2 wei)
//   sets status = 1 (claimable) again

There is no claimed[id][user] latch, no burn of the award NFT, no decrease of remaining reward budget.

Root cause#

A finite, shared inventory (the proxy's DHC) is paid out by a state machine that can walk backwards. Status 2 is not terminal. Dust re-participate is cheaper than the reward it re-enables, so the loop drains the vault one fixed reward at a time (~1,401 DHC per claim vs a 14,016 DHC "reward" parameter — the paid fraction is what matters).

Permissionless: the live caller is the attacker's contract, not proxy owner 0x007FA7F9….

Preconditions#

• Proxy holds a large DHC inventory (the prize).
• Attacker can register an inviter and createAward.
• Seed DHC to pledge once (flash-loaned USDT → Pancake).

Attack walkthrough#

Fixed reward constant REWARD = 0x2f7d64a231c0d4801fe. Reset amount = 2 wei.

attacker USDT before: 0
attacker USDT after:  71100.634971777945699789
attacker net profit (USDT): 71100.634971777945699789
[PASS] testExploit()

On-chain EOA received 71,851.0167 USDT; reconstruction is within ~1% (dump venue + inviter cut on the first pledge).

Diagrams#

Remediation#

1. Make claimed terminal. After claimAward, refuse participateAward on that id (or burn the position).
2. Lock collateral per award equal to the promised reward; pay from that bucket, not from a shared proxy balance.
3. Require participate amount ≥ remaining unclaimed reward (dust must not re-open a full payout).
4. Verify and publish the award impl; add an explicit status enum with a one-way Claimed latch.

How to reproduce#

_shared/run_poc.sh 2026-09-DHC_exp --mt testExploit -vvvvv

Fork is BSC (127.0.0.1:8546). Expected: [PASS] testExploit() with ~71,100 USDT profit.

Reference: https://x.com/clarahacks/status/2096127358189117721

References#

• https://x.com/exvulsec/status/2096119185621618858 (@exvulsec secondary analysis)

Sources & further analysis#

Reproductions & code

• Standalone PoC + full trace: 2026-09-DHC_exp (evm-hack-registry mirror).
• Upstream DeFiHackLabs PoC: DHC_exp.sol.

Alerts & third-party analyses

• Original alert / thread: post on X.
• DeFiHackLabs incident explorer: search "DHC Award vault".
• Web3Sec X hacked database: search.
• Rekt leaderboard: search.
• Solodit incident search: search.

These dashboards index community alerts tweets, post-mortems, and independent write-ups. Reach them through the protocol name above to cross-check this reproduction against other analyses.