Incident Overview
On October 24, 2024, Ramses Exchange on the Arbitrum network lost around $93,000 due to a flaw in its reward distribution system. The attacker repeatedly claimed rewards by leveraging multiple token IDs without reducing the overall reward pool supply. This exploit targeted Ramses’ reward accumulation process rather than affecting liquidity provider assets or user holdings.
Ramses Exchange confirmed that liquidity provider funds and user NFTs remain secure despite the incident.
The exploit stemmed from a vulnerability in the Ramses FeeDistributor contract, where the system failed to reduce the total reward supply after each reward claim. By repeatedly using the _getReward() function with multiple NFT token IDs, the attacker manipulated the reward calculations to gain excess rewards. The attacker’s strategy included resetting or splitting NFTs into new token IDs, effectively bypassing the tracking mechanism veWithdrawnTokenAmountByPeriod that restricts double-claiming within the same period.
Additionally, the attacker used the getPeriodReward() function with arbitrary period values to retroactively access unclaimed rewards, exploiting a lack of timestamp validation in the contract.
Exploit tx:
https://arbiscan.io/tx/0xb91c4e0d…4938bb
Attacker:
https://arbiscan.io/address/0x1d8b0ee3…6b977c
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Ramses, these are the critical security checks that could have prevented this incident (October 2024).
- Verify all logic paths related to Other are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next Ramses
The Ramses hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.