Cover Protocol Hack

The Cover Protocol hack exploited a critical vulnerability in the protocol's "Blacksmith" mining contract, which allowed for the minting of unlimited COVER tokens. The issue was in the reward distribution mechanism:

1. The attacker discovered that a bug in the getReward() function allowed minting tokens without proper validation
2. They deployed a custom contract to interact with the vulnerable Blacksmith contract
3. The exploit allowed them to mint tokens without having any actual stake in the protocol
4. This resulted in the creation of over 40 trillion COVER tokens

The vulnerability was in the reward calculation logic:

// Simplified representation of the vulnerable code
function getReward() public updateReward(msg.sender) {
    uint256 reward = earned(msg.sender);
    
    if (reward > 0) {
        rewards[msg.sender] = 0;
        
        // Vulnerability: No validation if caller actually had stake
        // and rewards were properly accrued
        IERC20(rewardToken).transfer(msg.sender, reward);
        
        emit RewardPaid(msg.sender, reward);
    }
}

function earned(address account) public view returns (uint256) {
    // Vulnerable calculation allowed manipulation
    return _calculateRewards(account);
}

The key issue was that the contract failed to validate that users had actually staked tokens and properly earned rewards before distributing them. The attacker was able to manipulate the reward calculation to mint unlimited tokens.