RoyalRoyalties exploit analysis

Royal1155LDA tracks each user's tier-balance in an internal mapping, updated on every ERC1155 batch transfer whether or not the transfer amount is zero. A fresh zero-balance sender batches 100 zero-amount tier-42 LDAs to a fresh receiver, and the receiver ends up with the mapping saying it holds 100 of tier 42 even though the supply is 1. The Royalties contract reads the receiver's tierBalanceOf as 100, so one deposit (the supply) is claimed at 100x pro-rata ownership against the royalty pool.

The attacker at 0xbd829aa63311bb1e3c0ea58a7193364de670bd56 used the historical attack contract 0x11ca9155aedfeb6772df5ea42ff714db7fba6adb to batch-transfer zero-amount tier-42 LDAs to a fresh receiver, then claimed royalty deposits at the inflated balance.

DeFiHackLabs reports a total loss of about 261,162.93 USDC. The drain is in 0x7a92106f145045b7a2bdce60a22109739f9b0cd0185bf16ff83fd1fac98cb42e on Polygonscan.

What would have prevented it: a Royal1155LDA updateTierBalance that requires amounts[i] > 0, or a Royalties tierBalanceOf that reads actual ERC1155 balances rather than a parallel mapping.