Digital Asset
Intelligence
Security Incident

MoneyMon Smart Contract Vulnerability: $85.52K Reported Loss

·Historical incident record

Incident Overview

The LegendaryMoneyMonNft contract’s cliamRewred function had a signature verification flaw. The verify() only checked if recoverSigner(...) == admin, without properly validating cases where ecrecover returns address(0). The attacker set admin to zero address, then used an invalid signature (r=0, s=0, v=27) to bypass checks, arbitrarily claim rewards, drain all tokens from the contract, and swap them for USDT via PancakeSwap.

Sources & References

Original incident referencehttps://x.com/SlowMist_Team/status/2060205558687486441 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Attack methodPrivate Key Leakage
    Reported loss$ 5,400,000
  2. Incident date
    Target

    YSDAO

    Attack methodReserve Manipulation Attack
    Reported loss$ 19,500
  3. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 10,000
  4. Incident date
    Target

    $TENDRIL

    Attack methodSmart Contract Vulnerability
    Reported loss$ 555000
  5. Incident date
    Attack methodUnknown
    Reported lossNot disclosed