ListaDAO has clarified that a recent attack on a contract named "ListaDAOLiquidStakingVault" was not on any of its official contracts but rather on a counterfeit contract deployed by an unverified third party. The attack, which occurred on April 16, 2026, exploited a business logic flaw in the fake contract, allowing the attacker to drain all assets. The GoPlus security team identified that the vulnerability involved the Dividend.setShares() function, which altered share accounting and affected reward calculations. GoPlus warns that similar vulnerabilities may exist in other projects that fork or reuse this code, urging developers to audit and secure their smart contracts promptly.