ElevateFi exploit analysis

ElevateFi's stake/un-stake cycle allowed restaking the same recorded balance against the next reward window without debiting the prior window's accrual. The attacker restaked the same principal against multiple consecutive windows and claimed each window's reward.

DeFiHackLabs reconstructs the sequence against the live Polygon state; the drain is in 0x2bd7213a764dd93d18dedeca7f4e0cf5c3cdce1739d79b53e41b72ec9efed87e on Polygonscan for a total loss of about $16,000.

What would have prevented it: restaking that requires the prior window's reward to be claimed first.