- HD-90Negative
GoPlus Security 🚦 (@GoPlusSecurity)
⚠️ Vulnerability Analysis: ListaDAOLiquidStakingVault Exploit On April 16, 2026, the ListaDAOLiquidStakingVault contract was exploited due to a flaw in its business logic. During token transfers (e.g., HD, JELLY), the Dividend.setShares() function is triggered, which alters share accounting within the Dividend contract. This, in turn, impacts the reward calculation in the claimReward() function of ListaDAOLiquidStakingVault. The attacker leveraged this flaw to drain assets from the contract. 🛡️ #Goplus Security Recommendations 1. Due to the presence of this logic flaw in both ListaDAOLiquidStakingVault and Dividend contracts, any forks or reused implementations are at high risk of exploitation. Developers and projects are strongly advised to review and patch accordingly. 2. Smart contract security should not rely on “one-time audits.” A new security paradigm is required — continuous auditing. Use GoPlus DeepScan for ongoing smart contract analysis, achieving higher efficiency and lower cost while improving security and reliability: https://deepscan.gopluslabs.io 📌 Additional Information Attacker: 0xa5C7AdC427c6db09E5B34629E2A05ECef4e4F14f 0x1e7Bd709fb53ef70F6B6f9C04b1bd2e77d0dE29A Attack Contracts: 0xeb21ab83220f8616a734047559a514b1d6996a15 0x00d6fe971a6dcaadb0a72eba3668f015acda0463 0x45d6517c6ae1f2e4bb633d85ec02900ecc60d175 0x2618255f51ab4b50b46f787d6406d9831c0c7057 Victim Contract: 0xF59818d53376d9BB6e9B3C0a264E3C610b59843D (ListaDAOLiquidStakingVault) Attack Transactions: https://bscscan.com/tx/0x767d8a0f2a6c2b5d1e3466bac47722a4f86a2bb9e41260dd52d274a9f100f312 https://bscscan.com/tx/0xd0d4c32389d20f02bb3c152af725d07906edec37b7b635507f4543ea442c9a71