@uniquebeing404

Today I got a reminder that shipping isn’t the finish line. Security is. We discovered an exploit in Shreds that allowed an attacker to repeatedly claim paid pack rewards without making valid purchases, draining the reward wallet. The smart contract wasn’t the issue. The vulnerability was in our backend validation flow. We were missing a critical rule: never trust client requests when rewards are involved. Every reward must be backed by verified onchain payment. We immediately investigated the attack, identified the root cause, and implemented fixes: • Every paid reward now requires verified onchain payment. • Approval transactions alone are rejected. • One purchase can only ever produce one reward. • Replay attempts are blocked. • Additional server-side validation and monitoring have been added. A tough lesson, but one that’s already making Shreds more secure. Back to building. Shred.signalify.xyz

0 reply

1 recast

1 reaction