Royal.io's legacy royalties contract (Royal1155LD) on Polygon was exploited via a flash loan combined with 100 zero-value ERC1155 transfers that manipulated the beforeLdaTransfer reward accounting hook through a logic flaw in the pro-rata royalty accounting function.

A legacy royalties contract (Royal1155LD) associated with Royal.io on Polygon was exploited due to a logic flaw in reward/pro-rata royalty accounting. The attacker used a flash loan and 100 zero-value ERC1155 transfers to manipulate the beforeLdaTransfer function, inflating balances and withdrawing ~$263K USDC.