# MetaSea: JIT open+redeem drains SEA distributor

MetaSea round paid full SEA yield on same-block open+redeem, letting a flash-loan-funded loop drain the shared distributor for ~$110K.

- Payout: Real-world hack
- Severity: high
- Program: SEAToken
- Credited: DeFiHackLabs
- Disclosed: 2026-05-17
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/SEAToken_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20260517-seatoken
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:reward-distribution

**Target:** MetaSea round contract redeemPosition / SEA distributor on Arbitrum
**Root cause:** redeemPosition() credits yield sized from the distributor's accumulated balance rather than time-weighted participation, and allows open+redeem atomically in the same block with no lockup or anti-JIT guard.
**Steps:**
1. Flash loan 3,300 USDT from Aave V3 pool `0x794a6135...14ad` via `flashLoanSimple`.
2. Loop 12x: swap 300 USDT -> ~2M SEA on Sushi pair `0xeeb9c6b7...0513`.
3. Call `openV6(roundId, 1)` on round `0xa70f31c0...7c5` with 3,000 USDT collateral (selector `0x987217bc`).
4. Approve SEA and call `redeemPosition()` (selector `0xf046d966`) in same tx; distributor transfers ~17-27M SEA to round, forwarded to attacker.
5. Sell received SEA back to USDT on Sushi pair; net ~1,200 USDT per cycle.
6. Repay flash loan + premium; repeat across 8 txs for ~$110K aggregate.
**How found:** On-chain trace showed a Transfer(distributor -> round, ~17M SEA) firing on every redeemPosition() with no commensurate SEA deposit by the redeemer, revealing yield sized from distributor balance rather than user contribution and same-block claimability.
**Exploitation:** Aave V3 flash loan of 3,300 USDT funds 12 open+redeem cycles in one tx; each cycle buys SEA, opens a 3,000 USDT round, immediately redeems to sweep ~17-27M SEA from the shared distributor, then dumps SEA on the Sushi SEA/USDT pair for USDT. Net ~1,200 USDT/cycle; attacker repeated 8 txs before pause.
**Escalation:** Repeated the identical attack 8 times back-to-back across blocks 463,840,948 -> 463,841,484, scaling losses ~linearly to ~$110K aggregate.
**Insight:** When a reward distributor pays a fixed quantum per claim, check whether open+claim can be atomic in one tx and whether payout is sized from pool balance rather than time-weighted stake; trace Transfer events from distributor to spot payouts uncorrelated with user deposits.