GoPlus Security Identifies Vulnerability in ListaDAO's Liquid Staking Vault

GoPlus Security has reported a vulnerability in ListaDAO's Liquid Staking Vault contract. According to ChainCatcher, the flaw in the business logic allowed attackers to exploit the Dividend contract's share calculation function during specific token transfers, affecting the reward distribution mechanism and resulting in the theft of significant assets from the contract. The security firm warns that this logic flaw is present in both the Liquid Staking Vault and Dividend contracts, posing a high risk of exploitation for any forks or reused implementations. Developers and projects are strongly advised to review and address these vulnerabilities promptly. GoPlus Security emphasizes that smart contract security should not rely solely on a one-time audit.