DoinGud Hack

Reported loss $35K
Polygon
Swap Logic Flaw

What happened

On September 21, 2026, an attacker drained the USDC escrow of the DoinGud NFT marketplace on Polygon by accepting the same offer twice. The marketplace's acceptOffer function, in an unverified Diamond facet, paid the offer price to the caller but never deleted or zeroed the offer record. It also did not stop the offer's creator from accepting their own offer, and an amount of 0 skipped the listing cleanup path.

Funded by a flash swap, the attacker made an offer of 35,486.935717 USDC and accepted it twice with identical calldata. The escrow paid out 70,973.87 USDC in total. The second payout came from other users' funds already held in escrow, about $35,487. After the 0.3% flash-swap fee the attacker kept about 35,380 USDC. No recovery had been reported.

Attacker EOA: 0xb8C717239BCACE558c3a8Dc471c16E07bF57a1Eb (helper contract 0xe588834AA3161a0720E8F6bf223748D6098a4B76). Attack tx: 0x56818a63077f5ba8bfc0bc0877ac33502a5d65cc79dbf5dfaac2a0b8545216a8.

How it happened

  1. The attacker flash-swapped 35,486.935717 USDC from a Uniswap V2-style USDC/miMATIC pair on Polygon.
  2. They called the marketplace's offer function, escrowing the borrowed USDC as an offer on token ID 1.
  3. They called acceptOffer on their own offer with amount = 0. The contract paid the offer price back to them, but the zero amount skipped the cleanup that would have retired the offer.
  4. Because the offer record was still live, they sent an identical acceptOffer call and were paid 35,486.935717 USDC again, this time from other users' escrowed funds.
  5. They repaid 35,593.716868 USDC to the pair and kept about 35,380 USDC.

Protocol details

Classification Protocol Logic
Protocol Type NFTfi
Implementation language Solidity

Evidence

Same attack technique

Browse all hacks →
BNB Chain CCC $117K lost BNB Chain DIP $111K lost Arbitrum VTSwapHook Loss not disclosed BNB Chain IPC AI $590K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes