<h3 id="overview">Overview:</h3><p>On October 24th, 2024, <a href="https://x.com/RamsesExchange" rel="noopener noreferrer nofollow">Ramses Exchange</a> on Arbitrum faced a sophisticated heist, losing over $90,000 due to a critical flaw in its reward distribution logic. An attacker uncovered a vulnerability that allowed them to claim rewards repeatedly across multiple tokenIds without ever decreasing the total rewards supply. By strategically depositing tokens and invoking getPeriodReward() with various NFTs, the attacker exploited the contract’s vulnerability to track reward limits per period, effectively draining the reward pools and executing a masterful raid on the exchange's assets.</p><h3 id="about-project">About Project:</h3><p>Ramses is a next-generation AMM designed to serve as Arbitrum’s central liquidity hub, combining the secure and battle-tested superiority of Uniswap v3 with a custom incentive engine, vote-lock governance model, and streamlined user experience.</p><h3 id="exploit-details">Exploit Details:</h3><p>Ramses Token Contract Address: <a href="https://arbiscan.io/token/0xaaa6c1e32c55a7bfa8066a6fae9b42650f262418" rel="noopener noreferrer nofollow">0xaaa6c1e32c55a7bfa8066a6fae9b42650f262418</a> Attack Transaction Hash: <a href="https://www.notion.so/f2b996166e23411f920e9e8b7e3e8d6d?pvs=21" rel="noopener noreferrer nofollow">0xb91c4e0debaf0feb1f20c979eebc1282c8024ae299ef5903591badcf1f4938bb</a> Attacker’s Address: <a href="https://arbiscan.io/address/0x1d8b0ee375750839567f266fa75f6fbc9d6b977c" rel="noopener noreferrer nofollow">0x1d8b0Ee375750839567f266FA75f6FBc9D6B977c</a></p><h3 id="attack-process">Attack Process:</h3><ul><li>The attacker discovered a vulnerability in Ramses Exchange’s reward distribution logic, which allowed rewards to be claimed multiple times without reducing the total rewards supply.</li><li>The attacker called the getPeriodReward() function with different NFT tokenIds, enabling them to claim rewards.</li><li>The contract failed to decrease tokenTotalSupplyByPeriod after each reward claim, leading to an inflated total reward supply.</li></ul><p><img src="https://cdn-images-1.medium.com/max/1280/1*BY2SKQCdXtEWOxVYW1BlHA.png"></p><ul><li>The attacker reset or split the original NFT into new tokenIds (e.g., from 18785 to 18787) to bypass the claim-tracking variable veWithdrawnTokenAmountByPeriod&nbsp;.</li><li>The new tokenIds allowed the attacker to repeatedly claim rewards as if they were different NFTs.</li><li>The attacker specified arbitrary period values in the getPeriodReward() function, allowing them to access previously unclaimed rewards from earlier periods due to the contract’s lack of period validation against the current time.</li></ul><p><img src="https://cdn-images-1.medium.com/max/1280/1*_8yBdbiKxKvgm2kRQy0wow.png"></p><ul><li>By repeatedly invoking getPeriodReward() and exploiting the inflated tokenTotalSupplyByPeriod, the attacker drained significant rewards from the exchange.</li><li>The attacker successfully transferred the stolen funds, resulting in a total loss of over $90,000 for Ramses Exchange.</li></ul><h3 id="the-rootcause">The Root&nbsp;Cause</h3><p>The root cause of the Ramses Exchange hack was a flaw in the reward distribution logic within the FeeDistributor contract. Specifically, the contract failed to decrease the tokenTotalSupplyByPeriod after each reward claim, resulting in an inflated reward supply. This oversight allowed the attacker to repeatedly claim rewards without a corresponding reduction in available rewards. Additionally, the getPeriodReward() function did not validate if the specified period matched the current time, enabling the attacker to exploit past periods for unclaimed rewards.</p><h3 id="flow-offunds">Flow of&nbsp;Funds</h3><p>The attacker deposited tokens, repeatedly invoked the getPeriodReward() function with different NFT tokenIds to claim excess rewards, and then transferred the stolen funds out of Ramses Exchange, resulting in a loss of over $90,000. Here’s the fund <a href="https://metasleuth.io/result/arbitrum/0xb91c4e0debaf0feb1f20c979eebc1282c8024ae299ef5903591badcf1f4938bb" rel="noopener noreferrer nofollow">flow</a>:</p><p><img src="https://cdn-images-1.medium.com/max/1280/1*mJS9X5rst2ge2MTQU8JI2g.png"></p><h3 id="post-exploitscenes">Post Exploit&nbsp;Scenes</h3><p>Here is what Ramses responded to the exploit in their discord: ”<strong>funds are safe. Liquidity provider funds are safe. User veNFT positions are safe.</strong>”</p><p><img src="https://cdn-images-1.medium.com/max/1280/1*Awp0oG2h10tSDWH3NrhG6A.png"></p><h3 id="how-could-they-have-prevented-theexploit">How could they have prevented the&nbsp;Exploit?</h3><ol><li><strong>Properly Decrementing tokenTotalSupplyByPeriod</strong>: Ensure that the tokenTotalSupplyByPeriod is decreased appropriately after each reward claim to prevent inflated reward calculations.</li><li><strong>Tracking Claims Per TokenId</strong>: Implement a robust mechanism to track rewards claimed per tokenId accurately, preventing the same tokenId from being used to claim rewards multiple times.</li><li>Enforce strict validation of the period values in the getPeriodReward() function to ensure they align with the current time and prevent retroactive claims.</li><li><strong>Conducting Thorough Audits</strong>: Engage reputable audit firms like QuiilAudits to conduct comprehensive security audits and fix potential vulnerabilities before they can be exploited.</li></ol><h3 id="why-quillaudits">Why QuillAudits?</h3><p>Choosing a reputable audit firm like <a href="https://www.quillaudits.com/smart-contract-audit" rel="noopener noreferrer nofollow">QuillAudits ensures that your protocol undergoes rigorous scrutiny</a> from experienced security professionals. QuillAudits specializes in uncovering critical vulnerabilities and providing actionable remediation strategies. Our expertise helps safeguard your project from attacks, ensuring that security issues are addressed proactively.</p>

Unraveling the $90K Mystery: Inside Ramses Exchange's Reward Exploit

Table of Contents

QuillAudits

Other articles published on Oct 28, 2024

Weekly Article Recap: 10/21-10/25

Hot New Crypto Lunex Could Become the Top DeFi Investment, Leaving Tron and Fantom Behind

Pump.fun Unveils New "Pump Advance" Trading Terminal, Teases Native Token Release

FTX Settles $228M Lawsuit with Bybit, Aims for $175M Recovery

Vitalik Buterin Calls Michael Saylor's Bitcoin Custody Remarks “Batsh*t Insane”

Binance Labs’ Latest Investment: What is Moonwalk Fitness?

Join our free newsletter for daily crypto updates!