Ramses Hack

On October 24, 2024, Ramses Exchange on the Arbitrum network lost around $93,000 due to a flaw in its reward distribution system. The attacker repeatedly claimed rewards by leveraging multiple token IDs without reducing the overall reward pool supply. This exploit targeted Ramses’ reward accumulation process rather than affecting liquidity provider assets or user holdings.

Ramses Exchange confirmed that liquidity provider funds and user NFTs remain secure despite the incident.

The exploit stemmed from a vulnerability in the Ramses FeeDistributor contract, where the system failed to reduce the total reward supply after each reward claim. By repeatedly using the _getReward() function with multiple NFT token IDs, the attacker manipulated the reward calculations to gain excess rewards. The attacker’s strategy included resetting or splitting NFTs into new token IDs, effectively bypassing the tracking mechanism veWithdrawnTokenAmountByPeriod that restricts double-claiming within the same period.

Additionally, the attacker used the getPeriodReward() function with arbitrary period values to retroactively access unclaimed rewards, exploiting a lack of timestamp validation in the contract.

Exploit tx:

https://arbiscan.io/tx/0xb91c4e0d…4938bb

Attacker:

https://arbiscan.io/address/0x1d8b0ee3…6b977c