The Idols NFT Hack

On January 14, 2025, The Idols NFT (@TheIdolsNFT) on Ethereum lost around $340,000 in stETH.

The vulnerability stemmed from a self-transfer scenario where _beforeTokenTransfer triggered _claimEthRewards(_from) and then _claimEthRewards(_to), both referencing the same address. When the sender’s NFT balance was just one, their reward snapshot was deleted, resetting the record of claimed rewards. As a result, the attacker’s next reward calculation considered an unclaimed snapshot (treated as zero), repeatedly granting the full stETH share all over again.

By performing multiple self-transfers in a row, the attacker continually reset their reward snapshot, ultimately siphoning off roughly $340,000 worth of stETH.

Exploiter

https://etherscan.io/address/0xe5464801…58d101