DoinGud’s acceptOffer settlement logic transferred an offer’s USDC price to the caller without deleting or zeroing the consumed offer record. Unlike cancelOffer, the acceptance path omitted the swap-and-pop cleanup. Missing checks also permitted the offerer to accept their own offer and permitted a zero NFT amount. By using amount=0, the attacker avoided listing cleanup and replayed identical acceptOffer calldata, causing the contract to pay the same offer repeatedly. A flash loan supplied the temporary USDC needed to construct the self-funded offer. Independent reporting likewise describes the exploit as failure to clear a bid after acceptance

The dormant NFT platform DoinGud was exploited on Polygon via a bug in its Diamond bidding contract: acceptBid paid out but never cleared the bid record, so the same bid could be reused. An attacker flash-loaned USDC equal to the contract balance, bid on themselves, accepted the bid twice, and drained about $35,486 USDC.e on September 21, 2026.