What happened
On August 16, 2022, an attacker exploited a NearX minting vulnerability in Stader's NEAR contract, minting 20 million NearX through a loop without matching staked NEAR. The attacker swapped those tokens for NEAR from Ref Finance and Jumbo Exchange liquidity pools; Stader estimated the proceeds at about 165,000 NEAR and said the 2.5 million NEAR staked through its app remained secure.
How it happened
- The attacker repeatedly transferred NearX to its own account to mint 20 million NearX without corresponding staked NEAR.
- It swapped the unbacked NearX for NEAR in the Ref Finance and Jumbo Exchange liquidity pools.
- Stader paused the NearX contract and halted NearX transactions.
- The team stated that the validator-staked NEAR was unaffected while it indexed LP losses and investigated recovery.
Protocol details
Classification
Yield Aggregator
Protocol Type
Exploit/Other
Affected asset / contract
NearX
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
