Projekt's $560K Loss and How Olympix Would Have Prevented It

Date: July 25, 2026

Chain: Ethereum

Loss: about 301.7 ETH, roughly $560K

Class: reward accounting that treated a token balance increase as proof of payment

At 01:11:59 UTC on July 25, 2026, a single Ethereum transaction took about 301.7 ETH out of Projekt's reward vault, and the wallet that sent it never paid for any of the purchases the vault rewarded. The attacker's working capital was roughly 14,000 WETH flash-loaned from Morpho, a loan that had to be borrowed and repaid inside one transaction, and none of it stayed with the attacker.

Projekt's GREEN/GOLD vault ran a buy-to-earn scheme that rewarded wallets for token purchases. The vault measured a purchase by watching a wallet's token balance go up, and it never checked that any ETH had actually been spent. Anything that pushed tokens into a wallet counted as a purchase, and the attacker found a way to push tokens in for free.

A Vault That Paid People for Buying

In a buy-to-earn design, the reward is the incentive and the purchase is the thing being rewarded, so the whole system depends on the vault knowing a real purchase happened. According to SlowMist's incident record, Projekt's vault exposed a permissionless function, trackPurchase, that anyone could call to record a purchase. It sized the purchase from a single number, the change in the wallet's token balance.

A token balance can change for many reasons that have nothing to do with buying. Someone can send you tokens, a pool can hand you its surplus, or a flash-loaned trade can route tokens through your address for a moment. The vault couldn't tell any of these apart from a genuine purchase, because it never looked at the ETH side of the trade.

What a Balance Delta Can and Can't Prove

A balance delta proves that tokens arrived, and the vault needed proof that the buyer paid for them. A shop that hands out loyalty points every time it sees a customer walk out with a bag, without ever checking the register, is making the same assumption, and anyone carrying an empty bag through the door gets paid.

Flash loans turn that gap into something anyone can exploit at scale. Because a flash loan lets anyone borrow a very large amount for the length of one transaction, any rule that rewards a temporary balance change can be triggered with borrowed money and no lasting cost. The vault's invariant, that reward credit should only follow ETH actually paid in, was never written into the code.

Fourteen Thousand Borrowed WETH

SlowMist's record and Defimon's alert lay out the attack in three moves. The attacker flash-loaned about 14,000 WETH from Morpho, 13,997.84 WETH on Etherscan, and pushed it into dozens of Uniswap V2 memecoin pairs, including Kirby Inu, Coin Merge, ApeBullInu and Beer-inu. In each pair, the attacker used skim(), a Uniswap V2 function that sends any token balance sitting above the pair's recorded reserve to an address the caller chooses, to move tokens into a wallet without a normal purchase.

Each of those balance increases looked like a buy to the vault, and trackPurchase recorded them as purchases and credited reward allocations against them. With the fake purchase history in place, the attacker called massWithdraw() and pulled about 301.7 ETH out of the reward pool, worth roughly $560,000. The flash loan was repaid, and the rewards stayed with the attacker. On Etherscan, the whole attack is one contract-creation transaction from the attacker's address that created 15 contracts, all of which self-destructed before it ended, with the vault's ETH paid out to one of them, 0x12D6...22f9, in a series of internal transfers.

What the Record Shows

Nominis and The Breach Ledger both list the Projekt incident at about $560,000, with The Breach Ledger giving the same 301.7 ETH figure and describing the same skim-based fake purchases followed by massWithdraw(). Defimon notes that the vault's contract is unverified, so its source can't be read on Etherscan. As of October 19, 2026, none of the public sources found included a statement from the Projekt team or a recovery.

How Olympix Infers the Rule the Vault Never Wrote Down

Olympix reads a contract the way an attacker does, as states, transitions and entry points. In Projekt's vault the states that matter are each wallet's recorded purchases and reward allocation, and every entry point that can raise them, trackPurchase first among them, is a path worth mapping. The engine also takes in what the vault is for, rewarding real buyers, and uses that context to infer the invariants the code depends on but never states.

Mapping every path is only useful if the engine knows where to aim, and that's the job of signals. Olympix's static analysis surfaces the one here: a permissionless function that writes to a reward ledger and sizes that write from nothing but a raw token balance difference, with no check on what was paid. Olympix has flagged this class before in other codebases, where a balance delta was trusted without verification, and the signal narrows the search from every path in the vault to the ones where an outside caller can move that number.

BugPoCer takes the vault's purpose as its starting point. It runs Counterexample-Guided Invariant Refutation, working outward from the whole reward system, and the rule it infers is the one the vault was built to honor without ever enforcing: a wallet's reward credit can never exceed what it actually paid in ETH. BugPoCer then executes paths through trackPurchase and massWithdraw() until one of them pays out credit that no ETH stands behind.

The counterexample BugPoCer returns is this exploit in miniature: borrow WETH, route it through a memecoin pair, skim tokens into a wallet, call trackPurchase, and watch reward credit appear for a wallet that paid nothing, then withdraw it. It comes with the minimal conditions that trigger it and a generated Forge test that replays it, so the July 25 drain shows up in development instead of on mainnet. Because Olympix runs automatically during development, at every merge and before release, a reward function like trackPurchase gets tested the moment it's written.

Reward the Payment Itself

Any contract that pays users for an action has to verify the action itself, because balance changes, donations and skims are side effects that a flash loan can manufacture on demand. Projekt's vault rewarded the side effect, and 301.7 ETH followed. To see how Olympix infers the rules your reward logic depends on and hands back a runnable counterexample for any path that breaks one, book a technical walkthrough.

On-Chain References

Protocol: Projekt GREEN/GOLD reward vault

Chain: Ethereum

Date: July 25, 2026, 01:11:59 UTC

Loss: about 301.7 ETH (about $560,000)

Flash loan source: Morpho, 13,997.84 WETH

Reward vault (victim, unverified): 0x574F...42CB

Attacker EOA: 0x61e7...4f85

Attack contract (received the vault's ETH): 0x12D6...22f9

Exploit tx: 0x90f4...0f64

Block: 25606412

Sources

Defimon: Projekt (GREEN/GOLD) reward vault exploit alert

SlowMist Hacked: Projekt incident record

The Breach Ledger: Weekly Exploit Snapshot

Nominis: Monthly Report, Crypto Exploits and Attacks in July 2026