X7 Finance Suffers Exploit Due to Accounting Bug
An accounting bug in X7 Finance's claimRewards() function was exploited, resulting in a loss of 6.78 ETH. The incident highlights a flaw in the reward calculation mechanism.
On October 8, 2026, X7 Finance experienced a security incident when an attacker exploited a bug in the claimRewards() function of X7Pioneer. The function was designed to update totalRewards based on the difference between the current balance and a previously recorded balance, but it only updated the recorded balance when there were claimable rewards. As a result, if the claimable rewards were zero, the function would repeatedly add the same unaccounted balance to totalRewards, inflating the rewards erroneously.
The attacker took advantage of this flaw by donating ETH to increase the difference between the current balance and the last recorded balance. This manipulation allowed the attacker to drain approximately 6.78 ETH from the system. The total loss from this exploit amounted to $16,514.
The incident occurred on the Ethereum chain, which allows for the tracing of transactions. The on-chain record would reflect the transactions associated with the exploit, including the donation and subsequent withdrawal of funds by the attacker. This incident serves as a reminder of the importance of robust auditing and testing of smart contract functions to prevent such vulnerabilities.