A reused-signature flaw in an outdated Rain Solana contract drained about $1.1 million from stablecoin card programs, Blockaid said.