Missing Parameter Check Lets Attacker Loop Skyward Finance's Treasury Dry

Skyward Finance, a token launchpad built on the NEAR blockchain, had its treasury emptied of 1.1 million NEAR — worth approximately $3.2 million at the time — in an exploit that sent the price of the SKYWARD token down by roughly 90%.

In its announcement, the team acknowledged plainly that the exploit had "render[ed] the Treasury and the $SKYWARD token effectively worthless." Because the protocol's contracts are fully immutable, the team could only confirm that ongoing and past token sales conducted through the platform remained unaffected, meaning funds and proceeds from those sales could still be withdrawn safely. For holders of the Treasury and SKYWARD token itself, however, there was no comparable reassurance — the team recommended users withdraw whatever funds they could and stop interacting with the protocol going forward.

Whether this stemmed from a straightforward coding oversight or something more deliberate remains an open question. Credit for the incident analysis goes to Sanket Naikwadi and BlockSec.

Mechanism: Shortly after 5pm UTC on November 2, 2022, the exploiter used the treasury's redeem_skyward function to redeem previously accumulated SKYWARD tokens for wNEAR. The function failed to properly validate its token_account_ids parameter, which allowed the attacker to repeatedly include their own withdrawal request within a single transaction, looping the redemption call and extracting wNEAR from the treasury on each pass. The attacker repeated this looped redemption until the treasury's wNEAR balance was fully drained.

Exploiter's address: 5ebc5ecca14a44175464d0e6a7d3b2a6890229cd5f19cfb29ce8b1651fd58d39 Attack transaction: 92Gq7zehKPwSSnpoZ7LGGtSmgmBb4wP2XNDVJqUZRGqz

Notably, this fairly simple vulnerability went unfound for more than a year after the protocol's launch — a gap that may reflect limited attacker attention on the NEAR ecosystem relative to other chains, though some in the community had already raised concerns before launch about whether project funds could disappear after a token sale.

This marks the 88th entry on the rekt leaderboard and the first involving a NEAR-based project.