A flaw in Dream Health Chain’s award state machine allowed the same fixed award to be claimed repeatedly. createAward() recorded a reward without reserving collateral for that award, while participateAward() allowed an already claimed award (status=2) to be reset to claimable (status=1). The attacker repeatedly reset and reclaimed awards for as little as a 0–1 wei transfer, draining funds from the contract’s shared proxy balance

Dream Health Chain’s staking/reward contracts on BSC were exploited for about 71,851 USDT. A broken award state machine allowed a claimed reward to be reset with a tiny or zero-effective DHC deposit, so the same fixed payout could be claimed repeatedly from the shared pool. The attacker looped pledge and claim, then sold about 542,070 DHC into the DHC-USDT pool.