The vulnerability occurs because Hydra's Claim validator omitted the requirement to spend the Head state‑token UTxO when a deposit is claimed. As a consequence, the validator does not enforce that the same transaction consumes this special token, leaving a pathway for an attacker to redirect assets to an arbitrary address. This flaw enables the theft of deposited funds before the deadline and bypasses all intended integrity checks.

The flaw affects the Hydra layer‑two scaling solution for Cardano, specifically deployments of the Hydra client running any version prior to 2.1.0. This includes versions that include the hydra-plutus/validators/deposit.ak code referenced in the publication. After the release of Hydra 2.1.0, the issue is addressed and existing vulnerabilities are closed.

Hydra was assigned a CVSS score of 8.2, indicating high severity. The EPSS score is not available, so the exploitation probability is unknown, but the flaw was present in a widely used scaling solution and there is no record that it has been exploited yet. The attack does not require prior insider access or privileged credentials; an adversary who can observe the on‑chain deposit transaction and has the ability to forge a transaction that consumes the pending UTxO before the pre‑defined deadline can re‑direct the assets. Because the missing state‑token requirement is checked at the validator level, the attack allows the attacker to bypass the intended safety controls, making the vulnerability particularly dangerous for any Hydra instance that has not applied the 2.1.0 fix.