X7 Finance loses ~6.78 ETH in claimRewards exploit, SlowMist reports

SlowMist's threat intelligence alert reports X7 Finance lost approximately 6.78 ETH in an exploit. The root cause is in claimRewards(), where totalRewards is incremented by (address(this).balance - lastETHBalance) on every call, but lastETHBalance is only updated when claimable is greater than 0, leaving a vulnerability when called with an empty array.

Detected & updated continuously · Source: Nebula