What happened
On April 27, 2025, an attacker drained about $7,000 worth of AVENTA from the Aventa project's reward-claim contract on Ethereum. AventaRewardClaim paid AVENTA to holders of the project's older IntelliQuant token, sized by the caller's IntelliQuant balance at the moment of the claim. Because it took no earlier snapshot of who held the token, anyone could buy IntelliQuant, claim, and sell again in one transaction.
The attacker ran that loop through a series of fresh helper contracts (the DeFiHackLabs reproduction uses 12). DeFiHackLabs puts the total taken at 16,019,528 AVENTA. The Defimon alert recorded a $7,026.61 balance change on the Owner wallet that funded the rewards. The attacker ended the run holding ETH.
How it happened
- Each helper contract took a 0.01 WETH flash swap from a Uniswap V2 pair.
- It swapped the WETH for IntelliQuant, so it now held a balance of the token being rewarded.
- It called
claim(address(this)). The only caller check wasuser == msg.sender, and on a first claimgetClaimableAmountpays 25% of the current IntelliQuant balance, taken from the Owner wallet throughtransferFrom. - It sold both the IntelliQuant and the AVENTA back to WETH, repaid the flash swap and sent the leftover ETH to the attacker EOA
0x7c982e93d6b1ede9626a84ebeafbc42e5991dee8. - The attack contract
0x0cdaa461d9d60ef84ded453fa1fbd3e2916f9016repeated this with new helper contracts (12 in the DeFiHackLabs reproduction) inside the attack transaction0x59446b1f58457c83d18864bbfaa8930c9438da33017ad41f08397cf79a8c63e5, so each address counted as a new claimant.
Protocol details
Evidence
- transaction Etherscan attack transaction 0x59446b1f...8c63e5 etherscan.io
- address Etherscan verified source, AventaRewardClaim etherscan.io
- analysis DeFiLlama defillama.com
- analysis DeFiHackLabs AventaRewardClaim_exp.sol PoC raw.githubusercontent.com
- analysis Defimon Alerts #927 and #928 (Telegram) t.me
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
