What happened
In mid-March 2026, Goose Finance's BNB Chain StrategyGooseEgg contract was exploited for about $8,435. BlockSec attributed the incident to the order in which the strategy minted shares and accounted for harvested rewards.
The strategy's share minting and reward-harvest accounting occurred in an unsafe order. Pending rewards were excluded when shares were created but included when shares were redeemed, allowing a user to capture value that should have been reflected in the deposit price.
How it happened
The vulnerable flow minted a depositor's shares before incorporating pending harvested rewards into the strategy's asset value. A later withdrawal triggered reward harvesting, so the share price used for redemption included value that had not been reflected at mint time. BlockSec reported that the attacker paired this accounting asymmetry with flash-borrowed capital, repeatedly entering and exiting the strategy to obtain more value on withdrawal than was represented at deposit.
Even a small incident demonstrates a general vault risk: deposits, withdrawals, and reward realization must use a consistent asset-accounting order.
Protocol details
Security review history
- CertiK View report
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
