What happened
In November 2022, Skyward Finance's NEAR treasury was drained of more than 1.1 million wrapped NEAR, reported at approximately $3 million. The Block, citing BlockSec, reported that the publicly callable token-redemption function failed to check duplicate token account IDs, enabling the attacker to redeem the same wrapped-NEAR payout repeatedly in one transaction.
How it happened
- Skyward's treasury allowed public redemption of Skyward tokens for wrapped NEAR.
- The redemption function accepted a list of token account IDs.
- It did not reject duplicate IDs, allowing the attacker to repeat the same account identifier.
- The contract paid the same wrapped-NEAR redemption repeatedly in a single transaction, draining more than 1.1 million wrapped NEAR.
Protocol details
Classification
Protocol Logic / Exchange (DEX) / Token / Input Validation
Protocol Type
Exploit/Other
Affected asset / contract
SKYWARD
Implementation language
Rust
Protocol links
Website
@skywardfinance
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
