PRXVT Hack

Reported loss $97K
Base
Transferable Receipt Token Reward-Accounting Flaw

What happened

PRXVT's Base staking contract was exploited on 1 January 2026 for roughly $97,000, reported as 32.8 ETH. The attacker repeatedly moved transferable staking receipt tokens to freshly deployed CREATE2 helper contracts, allowing each new recipient to claim historical rewards it had not earned.

Technical root cause

Transferable staking shares changed hands without updating sender and recipient reward checkpoints. A fresh holder could claim accrued rewards against transferred shares even though it had not earned that accrual.

How it happened

The staking receipt token was transferable, but its transfer path did not settle the reward checkpoints. The attacker staked once, moved the receipt tokens to a fresh CREATE2 helper with a default zero reward checkpoint, and had that helper claim rewards calculated from historical rewardPerToken. The tokens were returned and the cycle repeated with a new helper address, draining the shared reward reserve.

CREATE2 made the attack repeatable; the root problem was that reward accounting did not remain correct when receipt-token ownership changed.

Protocol details

Classification Protocol Logic / Token & Share Accounting
Protocol Type DeFi Protocol
Implementation language Solidity
Attacker Address 0x7407f9bdc4140d5e284ea7de32a9de6037842f45
Exploit Transaction 0xf42a8fe556d5e4ab59…7c48ff55a1

Evidence

Proof of concept

1 available

Sources

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes