# XLootStaking: duplicate xLOOT IDs in redeem drain rewards

XLootStaking.redeem processes duplicate NFT IDs before advancing redeem cursor, letting attacker claim epoch reward 1,085 times for 6.21 ETH profit.

- Payout: Real-world hack
- Severity: high
- Program: XLootStaking
- Credited: DefimonAlerts
- Disclosed: 2026-04-15
- Write-up quality: 8/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-04/XLootStaking_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260415-xlootstaking
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:source-review vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** Staking contract redeem function
**Root cause:** redeem(uint256[]) calculates all xLOOT rewards before advancing xLoot.nextRedeem[id], and only checks ownerOf(id) per entry, so the same owned NFT can be supplied many times in one call.
**Steps:**
1. Acquire 7 xLOOT NFTs (IDs 128,144,145,195,49,51,52) and transfer to attack contract.
2. Take 2.1 ETH Balancer flash loan of WETH.
3. Unwrap WETH to ETH and send to staking proxy to trigger receive() and commit next epoch.
4. Build array of the 7 IDs repeated 155 times each (1,085 entries).
5. Call `staking.redeem(redeemIds)`; claimableOf confirms amplified claim > debt.
6. Repay Balancer WETH, return NFTs, sweep ETH profit.
**How found:** Analysis of redeem logic: rewards calculated for all supplied IDs before cursor advancement, and only ownerOf check per ID, enabling duplicate ID amplification.
**Exploitation:** Attacker flash-loans 2.1 ETH WETH from Balancer, unwraps to ETH, sends to staking proxy to trigger epoch commit via receive(). Then calls redeem with 1,085 duplicate IDs, claiming the epoch reward 1,085 times. Repays flash loan and keeps 6.2098 ETH profit.
**Insight:** In reward-claiming loops, check whether per-ID state (like nextRedeem) is updated before or after the full loop; if after, duplicate IDs in the input array can multiply claims.