Projekt (GREEN/GOLD) Hack

On July 25, 2026, the Projekt (GREEN/GOLD) reward vault on Ethereum was exploited, resulting in the loss of approximately 301.7 ETH (valued at ~$560,000) due to a logic flaw in its buy-to-earn reward allocation tracking.

The exploit targeted a logic error in the reward vault's permissionless trackPurchase(buyer) function, which was designed to credit ETH allocations to buyers based on token balance deltas. Crucially, trackPurchase relied solely on token balance increases to calculate reward sizing without validating whether genuine ETH was spent to acquire those tokens.

To execute the attack, the exploiter secured a flash loan of approximately 14,000 WETH from Morpho. They pushed these funds into dozens of Uniswap V2 memecoin liquidity pairs (such as Kirby Inu and ROTTSCHILD) and invoked skim() to transfer the tokens directly to their contract. This self-dealing token movement inflated the buyer's balance delta, tricking the unverified trackPurchase function into registering massive fake "purchase" reward allocations at virtually zero net cost. Once the fake allocations were credited and the flash loan repaid in the same transaction, the attacker called massWithdraw() to drain ~301.7 ETH from the vault's reward pool.

Attacker Address: 0x61e7ad69…fc4f85

Victim / Vulnerable Contract: 0x574fc478…d442cb

Attack Transaction: 0x90f40d3c…410f64