Dream Health Chain Award Flaw Leads to $71.8k Loss
SlowMist identifies business-logic error in Dream Health Chain createAward and participateAward functions that enabled repeated reward claims.
Dream Health Chain recorded an approximately $71.8k loss after its award state machine permitted repeated withdrawals of the same reward.
Root cause
The createAward function records a fixed reward without locking any collateral or per-award reserve. The participateAward function does not require the award to be unclaimed, allowing reuse of the same entry.
Open questions
Exact on-chain loss size, transaction hashes, timestamps, and whether any funds have been recovered remain unconfirmed. It is also unknown whether a patch has been deployed or if the loss figure is fully realized.