What happened
On April 26, 2026, a reward-accumulator flaw in Scallop’s sSUI Spool contract on Sui drained approximately 150,098 SUI (about $142,500) from the rewards pool.
Technical root cause
The sSUI Spool reward accumulator lacked validation that prevented a new stake from receiving an inflated historical reward index, allowing fabricated reward points.
How it happened
The attacker deposited 0.2 SUI, abused the missing reward-index validation to generate about 162 trillion reward points, and redeemed those points for the entire sSUI rewards pool in one transaction.
Protocol details
Classification
Protocol Logic
Protocol Type
Lending
Implementation language
Move
Protocol links
Website
@Scallop_io
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
