What happened
On July 3, 2023, attackers repeatedly claimed BEAN from AzukiDAO’s airdrop contract using the same valid signature, making about $69,000. The contract recorded signatures but did not correctly reject reuse before the signature deadline, allowing the extracted BEAN to be swapped for ETH.
How it happened
- The attacker called the BEAN claim function with a valid signature.
- The claim released 31,250 BEAN.
- The attacker reused the same signature in repeated claim calls before expiry.
- The extracted BEAN was swapped for ETH, producing roughly 36 ETH in reported profit.
Protocol details
Classification
Protocol Logic / Input Validation / NFT / Token
Protocol Type
Exploit/Other
Affected asset / contract
Bean
Implementation language
Solidity
Protocol links
Website
@_AzukiDAO
Evidence
Proof of concept
1 availableSources
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
