# WhereIsMyDragonTreasure: fixed reward below mint cost drained

WhereIsMyDragonTreasure paid a fixed ETH reward for legendary cards that could be minted cheaper via recipe redemptions, netting $47k.

- Payout: Real-world hack
- Severity: high
- Program: WhereIsMyDragonTreasure
- Credited: DeFiHackLabs
- Disclosed: 2025-07-25
- Write-up quality: 6/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2025-07/WhereIsMyDragonTreasure_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20250725-whereismydragontreasure
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:business-logic

**Target:** Ethereum smart contract (EthItem ERC1155 recipe redemption + treasure reward)
**Root cause:** Treasure contract paid a fixed singleReward per legendary card, but the effective cost to mint a redeemable legendary card through the EthItem recipe path was lower than that fixed reward.
**Steps:**
1. Fork mainnet at block 23000243; read `data()` on TREASURE to confirm `singleReward = 12775839441940405641` wei.
2. Call `safeBatchTransferFrom` on EthItem ERC1155 to DRAGON 15x with recipe A ids/amounts (99,44,10).
3. Call recipe B 7x (200,346,2) and recipe C once (60,3,9) to mint 1 legendary card wrapper.
4. Transfer legendary card id (uint160 of wrapper) amount 1 to TREASURE via `safeTransferFrom`.
5. Receive fixed `singleReward` ETH; card burned.
**How found:** Likely spotted that the treasure's fixed `_singleReward` exceeded the combined recipe input cost to mint a legendary card, making redemption arbitrage profitable.
**Exploitation:** Attacker repeatedly submitted cheap EthItem recipe batch transfers to mint one legendary card, then redeemed it at the treasure contract for the fixed ETH reward exceeding total mint cost, repeating for profit.
**Insight:** When a contract pays a fixed reward for a token, compare that reward against every mint/acquire path for the token (recipe batches, secondary markets) — if any path is cheaper, redemption is a money printer.