SQTokenStaking exploit analysis
SQTokenStaking's `unstake` reward share was computed at claim time against the live total supply, so a same-block stake/unstake captured the next window's share. DeFiHackLabs reconstructs about $346.1K drained.
- Reported loss
- ~$346.1K, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-12: Access Control on SQTokenStaking”.
Analysis1 min read
SQTokenStaking's unstake returned the user's recorded stake plus a reward window's share, but the reward window's share was computed against the total staked supply at claim time, not at the user's stake time. The attacker called stake and unstake against the same block, with the reward window's share computed against a larger total than the user's actual exposure.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; the drain is in 0x1bae633eda9b3d98999ea116bc403712eaa07093ec32bd6d559085cc4607f5b8 on BscScan for a total loss of about $346.1K. DefiNerd_sec reported the incident.
What would have prevented it: a reward share computed at stake time, not at claim time, and pinned to the user's recorded stake.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260512-sqtokenstaking---reward-share-computed-at-claim-time
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/SQTokenStaking_exp.sol
- https://bscscan.com/tx/0x1bae633eda9b3d98999ea116bc403712eaa07093ec32bd6d559085cc4607f5b8
Other exploits
- SEAToken exploit analysis 17 May 2026
- VerusBridge exploit analysis 17 May 2026
- AdsharesBridge exploit analysis 15 May 2026
- HumaFinance exploit analysis 11 May 2026
- INKFinance exploit analysis 11 May 2026
- Renegade exploit analysis 10 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
