What happened
On June 23, 2026, Royal.io's deprecated Royal1155LD royalties contract on Polygon was exploited for approximately $263,000 in USDC through reward-accounting manipulation.
The deprecated contract recorded reward state against instantaneous ownership balances without protecting settlement from transient balance changes. Zero-value batch transfers could therefore inflate a tier balance and accrue rewards without a corresponding asset transfer.
How it happened
The attacker used a flash loan and repeated zero-value ERC-1155 transfers to manipulate the legacy contract's beforeLdaTransfer accounting, stack reward entitlements, and withdraw USDC from the royalty pool.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
