DoinGud Diamond Contract Bid Reuse Exploit

At 05:15 UTC on September 22, 2026, an attacker exploited a bug in DoinGud's Diamond proxy contract where the acceptBid() function failed to clear a bid record after payout, allowing bid reuse. Using a flash loan equal to the contract's full USDC balance ($35,487), the attacker placed a bid on themselves and accepted it twice, draining the contract. The bug had been independently discovered by security researcher teddyctf approximately one week prior; due to DoinGud being a dead project with no active team to contact, responsible disclosure was not completed before the exploit occurred.