LunaFi's reward claiming mechanism lacked a time lock in the claimRewards() function, allowing an attacker to repeatedly claim rewards using a malicious contract. The vulnerability enabled depositing, claiming, and withdrawing within a single transaction, generating profits while depleting the reward pool.

Polygon ecological project LunaFi was attacked. The attacker obtained initial funds from TornadoCash on BSC, the root cause was a flaw in reward calculation, and many other issues in the contract.