# AventaRewardClaim: balance-based claim lets helpers drain AVENTA allowance

AventaRewardClaim computed claims from the caller's current IntelliQuant balance and only checked user==msg.sender, letting fresh helper contracts buy IntelliQuant, claim AVENTA, and drain the owner allowance.

- Payout: Real-world hack
- Severity: high
- Program: AventaRewardClaim
- Credited: DeFiHackLabs
- Disclosed: 2025-04-27
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-04/AventaRewardClaim_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250427-aventarewardclaim
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:accounting-error vuln:business-logic vuln:reward-distribution

**Target:** AventaRewardClaim reward-claim contract on Ethereum mainnet
**Root cause:** Claim amount is derived from the user's current IntelliQuant token balance rather than a snapshotted/staked position, and the only access check is user == msg.sender, so any fresh address holding IntelliQuant can claim.
**Steps:**
1. Deploy batch contract spawning 12 helper contracts.
2. Each helper flash-swaps 0.01 WETH from Uniswap V2 pair `0xa210...b974`.
3. In `uniswapV2Call`, swap WETH -> IntelliQuant via router `0x7a25...488D`.
4. Call `AventaRewardClaim(0x33b8...4c73).claim(address(this))` to receive AVENTA from owner allowance.
5. Swap IntelliQuant and AVENTA back to WETH, repay flash loan (0.1% fee), withdraw and forward ETH to attacker.
**How found:** Reading the claim logic: amount derived from live IntelliQuant balance plus only user==msg.sender check implies any fresh address can mint a claim by briefly holding the token.
**Exploitation:** Attacker used 12 disposable helper contracts, each flash-borrowing 0.01 WETH, buying IntelliQuant, calling claim() to pull AVENTA from the owner's allowance, then selling both tokens for WETH and repaying the flash swap; net profit >3 ETH forwarded to attacker.
**Escalation:** Parallelized across 12 helper addresses to multiply claims against the same owner allowance.
**Insight:** When a reward/claim contract reads a live token balance instead of a snapshotted stake, test whether a flash-bought balance plus a fresh address satisfies the check and drains the funding allowance.