Pythia Hack

On 3 September 2024, an attacker drained about 21 ETH (around $53,000) from Pythia Finance's staking contract on Ethereum. QuillAudits reported the exploit. Cointelegraph describes Pythia as an algorithmic stablecoin project that planned to manage its treasury with AI.

The flaw was in how staking rewards were paid. The staking contract's verified source tracks rewards with a global rewards-per-share value (shareBasedPoints) and a per-holder pointsCorrection, and a claim pays shareBasedPoints times the holder's staked balance, adjusted by that correction. Staked positions (sPYTHIA) are ordinary ERC-20 tokens, and their transfers never call the contract's adjustPointsForTransfer helper. A fresh address that received sPYTHIA therefore had no correction and could claim rewards on its whole balance as if it had held it since the first distribution. The attacker (0xd861...74c0) used attack contract 0x5425...3647 to pass one staked position through a series of fresh helper contracts. Each helper claimed rewards on the full balance, and the attacker restaked what they collected. QuillAudits and Cointelegraph described the attack as a reentrancy on claimRewards. The public PoC, however, shows repeated claims across transferred balances rather than a callback loop.