XLootStaking exploit analysis
XLootStaking's reward share used the live `totalSupply()` at claim time, so the attacker minted and burned staking tokens around the claim. DeFiHackLabs reconstructs the drain.
- Reported loss
- 6.21 ETH, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-15: Duplicate Xloot Redemption on XLootStaking”.
Analysis1 min read
XLootStaking's reward distribution credited the user against the live totalSupply() of staking tokens at claim time. The attacker minted staking tokens to inflate totalSupply(), claimed a reward share at the inflated weight, then burned the staking tokens.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a reward share pinned to the user's recorded balance at stake time, not the live totalSupply().
Other exploits
- JuiceboxREVLoans exploit analysis 20 Apr 2026
- ThetanutsVaultShareRounding exploit analysis 20 Apr 2026
- AaveRebalancerCreditDelegation exploit analysis 19 Apr 2026
- MONA LisaVault exploit analysis 14 Apr 2026
- Saturn Protocol exploit analysis 14 Apr 2026
- SubQuerySettings exploit analysis 12 Apr 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
