Beosin: The Skyward Finance contract function did not verify the token_account_ids parameter correctly, causing the attacker to receive rewards repeatedly

According to the Beosin EagleEye security risk monitoring, early warning and blocking platform monitoring of the blockchain security audit company Beosin, the NEAR ecological project Skyward Finance project was attacked. Beosin analysis found that the redeem_skyward function of the skyward.near contract did not correctly verify the token_account_ids parameter , causing the attacker 5ebc5ecca14a44175464d0e6a7d3b2a6890229cd5f19cfb29ce8b1651fd58d39 to pass in the same token_account_id and claim WNEAR rewards multiple times. The attack caused the project to lose about 1.08 million NEAR, worth about $3.2 million. Beosin Trace tracked that the stolen funds had been moved by the attackers.