What happened
On January 14, 2025, The Idols NFT (@TheIdolsNFT) on Ethereum lost around $340,000 in stETH.
The vulnerability stemmed from a self-transfer scenario where _beforeTokenTransfer triggered _claimEthRewards(_from) and then _claimEthRewards(_to), both referencing the same address. When the sender’s NFT balance was just one, their reward snapshot was deleted, resetting the record of claimed rewards. As a result, the attacker’s next reward calculation considered an unclaimed snapshot (treated as zero), repeatedly granting the full stETH share all over again.
By performing multiple self-transfers in a row, the attacker continually reset their reward snapshot, ultimately siphoning off roughly $340,000 worth of stETH.
Protocol details
Security review history
- CertiK View report
Evidence
- report @Phalcon_xyz incident report x.com
- report @TheIdolsNFT incident report x.com
- report Report blog.solidityscan.com
- analysis DeFiLlama defillama.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
