POPA Recon@DoinGudHQ hacked for ~$35K USDC
@DoinGudHQ hacked for ~$35K USDC Rootcause: bids to be reusable - in acceptBid(bidder, id, price, qty), there are no SSTOREs other than for the reentrancy guard - the bid payout runs, but the bid record is never cleared. This meant anyone could flash loan USDC equal to the contract's balance, place a bid on themselves, and accept it twice - draining the contract. @EthSecurity1
The excerpt is quoted from a public Telegram channel, which owns its text.