LotteryTicket50 Smart Contract Nalakuvara Tokens Frained
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
A critical vulnerability in the `LotteryTicketSwap50` contract was exploited due to flawed logic in how it calculated ticket value and handled liquidity. Specifically, the contract used fixed ticket valuations and lacked slippage protection, allowing an attacker to manipulate token prices via flashloan and create profitable arbitrage. By repeatedly redeeming overvalued tickets for USDC, the attacker drained approximately $105.5K from the protocol. The exploit was flagged by TenArmor, but the identity behind the smart contract remains unknown, and no investigation or fund recovery has been publicly reported.
About Nalakuvara Token
Nalakuvara, also known as Nalakubara, is a figure in Hindu and Buddhist mythology. He is the son of Kubera, the yaksha king, and the brother of Manigriva (also known as Manibhadra). Nalakuvara is often depicted as a trickster figure, and his story is intertwined with themes of liberation and devotion to Krishna.
The Nalakuvara token smart contract was first launched on the Base chain on May 7th, 2025.
The Reality
Unfortunately, a vulnerability existed in the `LotteryTicketSwap50` contract due to its use of a fixed value calculation for LotteryTickets, which did not account for real-time market conditions. This meant that the value of the tickets remained constant regardless of fluctuations in the prices of the underlying tokens.
In addition, the `TransferToken` function lacked slippage protection when adding liquidity. The contract accepted token deposits without verifying whether the input values matched fair market rates, allowing liquidity to be added at arbitrary or manipulated prices.
Together, these design flaws created a pricing mismatch between the contract’s internal valuations and actual market dynamics. This inconsistency introduced a systemic risk, making the protocol susceptible to imbalanced operations when token prices deviated from the assumed fixed values.
What Happened
A vulnerability in the `LotteryTicketSwap50` contract—caused by fixed ticket valuations and lack of slippage protection—was exploited via flashloan manipulation, resulting in a loss of approximately $105.5K.
| Date | Event | Description |
|---|---|---|
| May 7th, 2025 9:26:53 PM MDT | Nalakuvara Smart Contract Created | The Nalakuvara token smart contract is first created on the Base chain. |
| May 9th, 2025 6:09:33 AM MDT | Exploit Transaction Happens | The exploit transaction occurs on the Base Chain. |
| May 9th, 2025 6:21:00 AM MDT | TenArmor Posts About Exploit | TenArmor makes a public post with details about the exploit transaction. |
Technical Details
The vulnerability originates from the flawed design of the `LotteryTicketSwap50` contract, specifically in the fixed value calculation of the LotteryTicket and the absence of slippage protection within the `TransferToken` function. This lack of safeguards allowed the attacker to manipulate token prices and exploit the discrepancy between the real market value and the hardcoded ticket valuation. Without mechanisms to account for price changes or to limit adverse liquidity impacts, the contract was left open to exploitation.
To execute the attack, the exploiter first manipulated the price of the Nalakuvara token using a flashloan, temporarily inflating or deflating its market value. This manipulation enabled them to create an artificial price discrepancy when adding liquidity through the vulnerable `TransferToken` function. Despite the manipulated token price, the USDC valuation of the LotteryTicket remained fixed, creating a profitable imbalance for the attacker to exploit.
Capitalizing on this arbitrage opportunity, the attacker used the inflated Nalakuvara tokens to swap for a larger amount of USDC. They then repeatedly redeemed their LotteryTickets for USDC by invoking the `DestructionOfLotteryTickets` function, profiting from the misalignment in valuation. This process was repeated, allowing the attacker to drain significant funds from the protocol before the exploit was discovered.
Total Amount Lost
TenArmor described "an approximately loss of $105.5K".
The total amount lost has been estimated at $106,000 USD.
Immediate Reactions
The incident was flagged by TenArmor. However, it is unclear what entity is behind the smart contract.
Ultimate Outcome
There does not appear to be any investigation or public announcement related to the exploit.
Total Amount Recovered
There is no indication that any funds have been recovered in this case.
There do not appear to have been any funds recovered in this case.
Ongoing Developments
There doesn't appear to be any ongoing investigation or any public announcements.
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ TenArmor - "Our system has detected a suspicious attack involving #Nalakuvara token and #LotteryTicket50 contract on #BASE, resulting in an approximately loss of $105.5K." - Twitter/X (Accessed Aug 1, 2025)
- ↑ LotteryTicket50 Nalakuvara Token Exploit - BSCScan (Accessed Aug 1, 2025)
- ↑ Week 19, 2025 - Blockthreat (Accessed Aug 1, 2025)
- ↑ Nalakuvara Token Smart Contract - BaseScan (Accessed Aug 1, 2025)
- ↑ Nalakuvara Token Smart Contract Creation - BaseScan (Accessed Aug 1, 2025)
- ↑ Nalakuvara - Wikipedia (Accessed Aug 1, 2025)