Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/lotteryticket50smartcontractnalakuvaratokensfrained.php}} {{Unattributed Sources}} Base Blockchain Logo/HomepageA critical vulnerability in the `LotteryTicketSwap50` contract was exploited due to flawed logic in how it calculated ticket value and handled liquidity. Specifically, the contract used fixed ticket valuations and lacked slippage protection, a..."

2025-08-27T20:36:51Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/lotteryticket50smartcontractnalakuvaratokensfrained.php}} {{Unattributed Sources}} thumb|Base Blockchain Logo/HomepageA critical vulnerability in the `LotteryTicketSwap50` contract was exploited due to flawed logic in how it calculated ticket value and handled liquidity. Specifically, the contract used fixed ticket valuations and lacked slippage protection, a..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/lotteryticket50smartcontractnalakuvaratokensfrained.php}}
{{Unattributed Sources}}

[[File:Baseblockchain.jpg|thumb|Base Blockchain Logo/Homepage]]A critical vulnerability in the `LotteryTicketSwap50` contract was exploited due to flawed logic in how it calculated ticket value and handled liquidity. Specifically, the contract used fixed ticket valuations and lacked slippage protection, allowing an attacker to manipulate token prices via flashloan and create profitable arbitrage. By repeatedly redeeming overvalued tickets for USDC, the attacker drained approximately $105.5K from the protocol. The exploit was flagged by TenArmor, but the identity behind the smart contract remains unknown, and no investigation or fund recovery has been publicly reported.
<ref name="tenarmortweet-20887" /><ref name="attacktransaction-20888" /><ref name="blockthreat-20889" /><ref name="nalakuvarabasescan-20890" /><ref name="nalakuvaracontractcreation-20891" /><ref name="nalakuvarawikipedia-20892" />

== About Nalakuvara Token ==
Nalakuvara, also known as Nalakubara, is a figure in Hindu and Buddhist mythology. He is the son of Kubera, the yaksha king, and the brother of Manigriva (also known as Manibhadra). Nalakuvara is often depicted as a trickster figure, and his story is intertwined with themes of liberation and devotion to Krishna.

The Nalakuvara token smart contract was first launched on the Base chain on May 7th, 2025.

== The Reality ==
Unfortunately, a vulnerability existed in the `LotteryTicketSwap50` contract due to its use of a fixed value calculation for LotteryTickets, which did not account for real-time market conditions. This meant that the value of the tickets remained constant regardless of fluctuations in the prices of the underlying tokens.

In addition, the `TransferToken` function lacked slippage protection when adding liquidity. The contract accepted token deposits without verifying whether the input values matched fair market rates, allowing liquidity to be added at arbitrary or manipulated prices.

Together, these design flaws created a pricing mismatch between the contract’s internal valuations and actual market dynamics. This inconsistency introduced a systemic risk, making the protocol susceptible to imbalanced operations when token prices deviated from the assumed fixed values.

== What Happened ==
A vulnerability in the `LotteryTicketSwap50` contract—caused by fixed ticket valuations and lack of slippage protection—was exploited via flashloan manipulation, resulting in a loss of approximately $105.5K.

{| class="wikitable"
|+Key Event Timeline - LotteryTicket50 Smart Contract Nalakuvara Tokens Frained
!Date
!Event
!Description
|-
|May 7th, 2025 9:26:53 PM MDT
|Nalakuvara Smart Contract Created
|The Nalakuvara token smart contract is first created on the Base chain.
|-
|May 9th, 2025 6:09:33 AM MDT
|Exploit Transaction Happens
|The exploit transaction occurs on the Base Chain.
|-
|May 9th, 2025 6:21:00 AM MDT
|TenArmor Posts About Exploit
|TenArmor makes a public post with details about the exploit transaction.
|}

== Technical Details ==
The vulnerability originates from the flawed design of the `LotteryTicketSwap50` contract, specifically in the fixed value calculation of the LotteryTicket and the absence of slippage protection within the `TransferToken` function. This lack of safeguards allowed the attacker to manipulate token prices and exploit the discrepancy between the real market value and the hardcoded ticket valuation. Without mechanisms to account for price changes or to limit adverse liquidity impacts, the contract was left open to exploitation.

To execute the attack, the exploiter first manipulated the price of the Nalakuvara token using a flashloan, temporarily inflating or deflating its market value. This manipulation enabled them to create an artificial price discrepancy when adding liquidity through the vulnerable `TransferToken` function. Despite the manipulated token price, the USDC valuation of the LotteryTicket remained fixed, creating a profitable imbalance for the attacker to exploit.

Capitalizing on this arbitrage opportunity, the attacker used the inflated Nalakuvara tokens to swap for a larger amount of USDC. They then repeatedly redeemed their LotteryTickets for USDC by invoking the `DestructionOfLotteryTickets` function, profiting from the misalignment in valuation. This process was repeated, allowing the attacker to drain significant funds from the protocol before the exploit was discovered.

== Total Amount Lost ==
TenArmor described "an approximately loss of $105.5K".

The total amount lost has been estimated at $106,000 USD.

== Immediate Reactions ==
The incident was flagged by TenArmor. However, it is unclear what entity is behind the smart contract.

== Ultimate Outcome ==
There does not appear to be any investigation or public announcement related to the exploit.

== Total Amount Recovered ==
There is no indication that any funds have been recovered in this case.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
There doesn't appear to be any ongoing investigation or any public announcements.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="tenarmortweet-20887">[https://twitter.com/TenArmorAlert/status/1920816516653617318 TenArmor - "Our system has detected a suspicious attack involving #Nalakuvara token and #LotteryTicket50 contract on #BASE, resulting in an approximately loss of $105.5K." - Twitter/X] (Accessed Aug 1, 2025)</ref>

<ref name="attacktransaction-20888">[https://basescan.org/tx/0x16a99aef4fab36c84ba4616668a03a5b37caa12e2fc48923dba4e711d2094699 LotteryTicket50 Nalakuvara Token Exploit - BSCScan] (Accessed Aug 1, 2025)</ref>

<ref name="blockthreat-20889">[https://newsletter.blockthreat.io/p/blockthreat-week-19-2025 Week 19, 2025 - Blockthreat] (Accessed Aug 1, 2025)</ref>

<ref name="nalakuvarabasescan-20890">[https://basescan.org/address/0xb39392f4b6d92a6bd560ed260c2c488081aab8e9 Nalakuvara Token Smart Contract - BaseScan] (Accessed Aug 1, 2025)</ref>

<ref name="nalakuvaracontractcreation-20891">[https://basescan.org/tx/0xc7011114f78ecae87687fc51b396e78a5ba7cf136b6b17b53a2f501c53a8719a Nalakuvara Token Smart Contract Creation - BaseScan] (Accessed Aug 1, 2025)</ref>

<ref name="nalakuvarawikipedia-20892">[https://en.wikipedia.org/wiki/Nalakuvara Nalakuvara - Wikipedia] (Accessed Aug 1, 2025)</ref></references>

LotteryTicket50 Smart Contract Nalakuvara Tokens Frained - Revision history