Projekt reward vault attacked July 25, 2026 for $560K via flashloan exploit. Attacker flash-loaned 14K WETH from Morpho to create fake purchase records in the unvalidated trackPurchase function, inflating reward allocations and draining ~301.7 ETH via massWithdraw.

The Projekt (GREEN/GOLD) reward vault on Ethereum was exploited. The attacker flash-loaned ~14K WETH from Morpho, pushed it into multiple Uniswap V2 memecoin pairs and used skim() to create fake “purchase” records. Exploiting the permissionless trackPurchase function (which only reads token balance deltas to size rewards without verifying actual ETH spent), they inflated reward allocations and drained ~301.7 ETH (~$560K) from the vault’s reward pool via massWithdraw.