What happened
StepHeroNFTs on BNB Smart Chain was drained through reentrancy in its referral-payment flow. A receiving contract repeatedly re-entered claimReferral during a payment callback.
Technical root cause
The referral-claim flow made an external payment before completing its state update and lacked effective reentrancy protection. The receiving contract could revisit the payment path while the previous entitlement remained usable.
How it happened
- The attacker invoked claimReferral through a contract able to receive payments.
- The payment transferred control to the receiving contract before referral accounting was finalized.
- The receiver recursively called claimReferral, collecting repeated payments against the same entitlement.
Protocol details
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
