Reproduced Exploits

Atomic (AtomicLending) — Signature Replay + Flash-Loan Spot Manipulation on Arbitrum (~$29,984)

Loss · ~$29,984.27 USDC (native USDC on Arbitrum)

Two independent alerts describe the same drain from two depths:

Base Unverified Arbitrary CALL — Allowance Drain via 0x42be3129

Loss · ~16.623 WETH (~$31k, SlowMist TI)

1. An unverified Base contract holds a privileged pattern: a public function that performs a low-level CALL to an arbitrary target with attacker-controlled calldata (Slo…

LpdFi — Spot-Oracle Price Manipulation Drains Protocol LP via claimInterest

Loss · ~693,529.79 USDC (~$690K) drained from protocol LPD/USDC LP in the claim tx; public repor…

1. LpdFi is a staking product. Users deposit LPD, open an “order” denominated in a notional uAmount (USDC units), and earn 0.5%/day interest (capped at 50% of uAmount).…

MOKE LP Dividend Drain — Stale `userLPRecord` Double-Claim via Unsynced LP Transfers

Loss · ~$907.7K (~1,546.5 BNB net to the attacker in the live tx; PoC drains ~1,639 BNB of a 1,6…

1. MokeLPDividend pays BNB dividends proportional to MOKE/WBNB LP holdings, using a MasterChef-style debt model: userLPRecord, userDividendDebt, and global totalDividend…

NEX/AIC FoT Skim — Router Double-Transfer + Sell Fee Lets skim() Empty the Pair

Loss · ~32.36 BNB (~$19.1K) (32361267289208020008 wei) — exact match to the live attack tx

1. NEX is a fee-on-transfer token with a 6% dao sell fee when the recipient is an AMM pair, and a special branch that is meant to skip fees when either side of the trans…

StrongBlock Governance Takeover — Abandoned Governor → Malicious Upgrade → Pool Drain

Loss · ~$72K — 32,695.76 STRONG + 383,447.17 STRNGR

1. StrongBlock left an on-chain Governor with live upgrade authority, while the STRONG vote token was economically worthless — so majority voting power was cheap. 2. Att…

Unistreets LaunchpadFactoryAuto — Arbitrary Calldata Injection → V4 LP Burn (2-tx, 2-victim confused deputy)

LaunchpadFactoryAuto is the ERC-721 owner of the Uniswap v4 liquidity position minted for every token it launches. Its launch() function takes a caller-controlled modify…

USM / FUM (Minimalist USD) — Flash-loan fund/defund extracts ETH buffer via inflated mid-price

Loss · ~70.83 ETH (~$160K) drained from the USM ETH pool; PoC profit 70.831554410317728328 WETH

1. Minimalist USM is an ETH-backed stablecoin; FUM is the buffer/equity token. Users fund() ETH to mint FUM and defund() FUM to redeem ETH from the shared pool.

ZKPanther (Base) — Reality.eth governance module → proxy upgrades → ZKP drain

Loss · ~5.12M ZKP (~$15.6k at ~$0.003/ZKP) + ~0.123 ETH; team: Base zone not yet in production,…

1. Panther’s Base DAO is a Gnosis Safe with a Zodiac RealityModuleETH clone: anyone can addProposal, and a Reality.eth “yes” answer with only a 0.5 ETH bond becomes exec…

BarnBridge SMART Yield — Governance Capture of an Abandoned DAO → Controller Swap → Approval Drain

Loss · 776,575.547933 USDC (drain #1 774,943.379409 + drain #2 1,632.168524)

---

Bonzo Lend / Supra Oracle — BLS Zero-Signature Price Forgery

Loss · ~$9.05M Wallet A principal (BlockSec / Bonzo Finance; excludes ~$1.0M white-hat Wallet B)

1. Bonzo Lend prices ecosystem collateral (including SAUCE) from Supra's on-chain pull-oracle feed. It does not re-verify committee signatures; it reads the latest store…

CrowdRingCircle Exploit — Premature `sync()` Turns a Sell-Tax Burn into a Free Reserve Drain

Loss · 201,359.443861203526776802 USDT (~$201.36K) extracted from the CRC/USDT PancakeSwap pair…

CRC is a BEP-20 token with a "sell tax + sell destroy" mechanism: every transfer that lands on a registered DEX pair first skims a 10% fee, then additionally burns up to…

Drips Network DaiDripsHub `give()` — `uint128 → int128` cast flips fund flow

Loss · 24,882.995421947667857715 DAI (full DaiReserve balance at attack block)

1. Drips Network’s DAI hub lets any user call give(receiver, amt) to gift DAI stream collectable balance to a receiver. Accounting debits the giver via a signed _transfe…

Edel xStock — ERC4626 convertToAssets Donation Inflates Collateral and Drains Reserves

Loss · 204,215.57 USDC + multi-asset xStock wrappers (wSPYx/wQQQx/wMSTRx/wNVDAx/wTSLAx)

1. Edel markets treat wrapped xStock tokens (e.g. wGOOGLx) as collateral. Pricing goes through an AaveOracle path that ultimately depends on the wrapper's live convertTo…

Hinkal Shielded Pool — Legacy Note Multi-Nullifier Double-Spend

Loss · ~$800K–$822K USDC (+ other assets) drained from Hinkal privacy pool(s)

1. Hinkal is a shielded pool: deposits become commitments in an on-chain Merkle tree; spends present a ZK proof plus a nullifier. The contract records each nullifier and…

Index Coop ExchangeIssuance TOCTOU — Unlocked SetToken Units + Malicious Manager Hook Drain Residual Inventory

Loss · ~\$9.6K USD (SlowMist TI). PoC drains residual EI inventory including ~436.70 LINK and ~4…

1. Index Coop ExchangeIssuance lets anyone call issueSetForExactToken for any controller-registered SetToken. It reads that SetToken's component real units to size swaps…

Lumi Finance (Sodium ERC-4337 account) — Signature-Bypass Drain

Loss · Multi-asset drain across ~50 Sodium smart accounts (≈ $264k reported). This fork replay m…

Sodium is Lumi Finance's ERC-4337 v0.6 smart-account wallet, and its owner check is forgeable: it trusts a signer address taken from the attacker-supplied UserOperation…

NFT Auction Marketplace Exploit — Settle-Then-Cancel Double Payout Drains the Escrow Pool

Loss · 2.217610999999999999 BNB (~$4.15k) — the marketplace's entire escrowed BNB balance, drain…

The marketplace tracks each listing's escrowed BNB (the buyer's payment) in a single Sale struct keyed by saleId. completeAuction (called via buyNow) transfers the NFT t…

Perpetual Protocol (Curie) Exploit — Missing Access Control on `OrderBook.updateFundingGrowthAndLiquidityCoefficientInFundingPayment()`

Loss · 3,062.213107 USDC.e (=$3,062.21) drained in this single transaction

Perpetual Protocol V2 ("Curie") is a perpetual-futures DEX that reuses Uniswap V3's concentrated-liquidity math as its virtual AMM. Its OrderBook contract tracks each li…

RWT Token Exploit — Owner-Gated `burn()` Lets a Role-Holder Delete an AMM Pair's Own Reserve

Loss · ~118,069.28 USDT extracted in this reproduction (assertApproxEqAbs target ~118,000 USDT);…

RWT (0xf8A3…) ships a custom burn(address _From, uint256 _amount) external onlyOwner that calls _burn(_From, _amount) directly — no allowance check, no restriction on _F…

Sodium Smart Wallet Exploit — ERC-4337 Session-Key Validation Bypass / EntryPoint Gas-Deposit Griefing

Loss · ~11.76 ETH (~$21,200), drained from 300+ Sodium smart-wallet accounts in a single transac…

Sodium is an ERC-4337 smart-contract wallet ("ZK/MPC" marketed) built on a Gnosis-Safe-style architecture: every user gets a minimal proxy that delegatecalls a single sh…

Summer.fi FleetCommander — NAV Inflation via Empty-Ark Donation of Undervalued vgUSDC

Loss · ~5.60M DAI reproduced on FleetA (5597682112787981084159961 wei); full incident ~6.02M inc…

1. Summer.fi Lazy Summer FleetCommander prices shares from the sum of each ark's totalAssets() with no smoothing, donation resistance, or empty-ark gate.

AIDCToken sell-burn drains the AMM pair reserve — deflation logic burns tokens from the LP without a counterpart

Loss · ~220.13 WBNB (≈ $132k at BNB ≈ $600)

AIDC is an ERC-20 ("AI Data Credit") with a custom AMM tax. On every non-whitelisted sell into the PancakeSwap V2 AIDC/WBNB pair, _sellTransfer does not actually burn an…

AISOTH Presale Exploit — Same-Tx Buy+Claim of Below-Market Inventory, Dumped Into the Live AIS/USDT Pair

Loss · 30,314.76 USDT profit to the attacker (30314760842915494215340 wei), extracted from the A…

1. Presale (Presale.sol) sells AIS for USDT at a fixed administrative price of price = 35e15 (i.e. $0.035 per AIS, Presale.sol:58-59). It holds a real inventory of AIS d…

Ambient (CrocSwap) Exploit — Native-ETH Surplus Settlement Drained via a Self-Dealt Grid-Walk + Range Harvest

Loss · ~33.72 WETH + ~55,913.81 USDC extracted from Ambient's ETH/USDC pool in a single tx (33.7…

1. Ambient (CrocSwap) is a single-contract concentrated-liquidity AMM. Every user action — swap, mint, burn, harvest — is dispatched as a userCmd(callpath, cmd) into one…

ATM LP-Burn Exploit — Misplaced LP Tokens Are Burn-Redeemable by Anyone via PancakeV2 `burn()`

Loss · 1,603.99 WBNB redeemed out of the ATM/WBNB pair (~$1.6M-class drain of the pool's WBNB si…

1. The ATM/WBNB pair is a stock PancakeSwap V2 pair (PancakePair, Solidity 0.5.16). Its burn(address to) function redeems liquidity equal to balanceOf[address(this)] — i…

ATM Token Exploit — Per-Address Anti-Whale Guards Sidestepped by 30 Sybil "Farmer" Clones

Loss · ~$243,543 USDT gross drained from the ATM/USDT PancakeSwap pair in the cash-out tx (attac…

ATMToken is a PancakeSwap-listed "tax token" with a thick layer of anti-whale / anti-bot protections bolted onto its custom _transfer() (contracts_ATMToken.sol:85-210).…

ATOHook Solady ReentrancyGuard Storage Collision — Inflated `getReward()` Drain

Loss · 14.411518807585587 ETH (exactly 200 × 0xffffffffffffff wei)

1. ATOHook is a Uniswap v4 hook with a Synthetix-style native ETH reward stream. Accrued balances live in mapping(address => uint256) public rewards at base slot 17.

Aztec Connect (V3) Exploit — `numRealTxs` proof-vs-settlement coverage mismatch

Loss · ~$2.19M total drained from the dormant Aztec Connect privacy bridge. This PoC reproduces…

1. RollupProcessorV3.decodeProof() (Decoder.sol:281) computes the publicInputsHash by SHA256-hashing the transaction data in full inner-rollup chunks. The number of non-…

Aztec Escape-Hatch Exploit (variant 2) — Unconstrained Inner `proof_id` Witness

Loss · educational reproduction (the Connect contracts were already drained via exp1); disclosur…

Per the embedded root cause: escape_hatch_circuit.cpp publishes the inner proof id with public_witness_ct(&composer, 0); // proof_id. public_witness_ct() makes the value…

Aztec V1 Escape-Hatch Exploit — Unbacked Withdrawals via Verifier-Trusted Rollup Proofs

Loss · ~$2.2M — 1,158 ETH + 150,000 DAI + 0.46963295 renBTC drained from the Aztec V1 rollup's p…

1. The Aztec V1 rollup exposes escapeHatch(bytes proofData, bytes signatures, bytes viewingKeys) (contracts_RollupProcessor.sol:347-356) — a permissionless exit path. Un…

BOSS Exploit — Helper Mint/Burn Drains the Pair's BOSS Reserve, then a Degenerate-Reserve Swap Loop Empties the USDT Side

Loss · ~10,207.54 USDT (PoC nets 10,210.15 USDT to the attacker EOA) drained from the BOSS/USDT…

1. The attacker borrows 1,250,000 USDT from a Moolah flash loan (output.txt:67) and enters its own onMoolahFlashLoan callback. 2. It calls the privileged BOSS helper's u…

BY Token Exploit — Permissionless `triggerAutoBurn()` Pool-Reserve Drain

Loss · ~$87,402 — 146.60 WBNB drained from the BY/WBNB PancakeSwap pair

BYToken is a deflationary token whose _autoBurn() routine, when the token contract's own balance is insufficient, burns BY tokens directly out of the AMM pair's balance…

Cook Finance Issuance — Caller-Chosen Weightings Drain CKToken Components via Thin Pancake Pools

Loss · ~2.82 BNB net profit to the attacker (2816924852223933205 wei), extracted from a Cook Fin…

1. Cook's IssuanceModuleV2.issueWithSingleToken2 (IssuanceModuleV2.sol:3124-3153) lets anyone mint a CKToken by supplying a single component token and a caller-chosen _w…

DIP Exploit — Fee-on-Sell Transfer + `skim`/`sync` Reserve-Collapse on the DIP/AIC Pair

Loss · ~111,097.59 USDC (PoC header); the trace asserts 111,102.04 USDC profit drained from the…

1. DIP is a PancakeSwap-traded ERC20 with a custom _transfer override (contracts_flatten_nexus_dip.sol:1702-1732) that charges a 6% sell fee (sellFee = 6) on any transfe…

DLMC Exploit — Reserve-Derived `livePrice` Self-Inflation Drains the Token's Own USDT Backing

Loss · ~$222,560 — 222,560.22 USDT drained from DLMCToken's own USDT reserve (output.txt:337); t…

1. DLMCToken is an MLM-style "investment" token. Users buy() LPT with USDT, which is kept inside the token contract, and later sell() LPT back for USDT. The redemption p…

DTXT Exploit — 1-Wei USDT Donation Misclassifies a Sell as a Liquidity Add (Fee Bypass + Stale-Reserve Drain)

Loss · ~35,041.11 USDT drained from the DTXT/USDT PancakeSwap pair (the pool's entire ~35,637 US…

1. DTXT is a fee-on-transfer token. On a sell (a transfer to the AMM pair) it skims a 5% destroy/dividend fee in _transfer (DTXT.sol:933-940). But before charging any fe…

Gnosis Pay / Zodiac Delay — `moduleTxSignedBy` ignores EIP-1271 `staticcall` success

1. Gnosis Pay card accounts are Safe smart accounts with Zodiac Roles + Delay modules. Outgoing non-card transfers queue in Delay for a short cooldown (txCooldown = 180…

JaredFromSubway MEV Bot — Residual ERC-20 Approvals to Untrusted Bait Wrappers

Loss · CertiK ~4,424 ETH (~$7.5M) after stables → ETH conversion; other outlets cite ~$7.5–15M c…

1. Over weeks, an attacker deployed ~66 fake tokens / forged Uniswap-v2-style pairs and bait wrappers that looked like profitable sandwich / multi-hop arb opportunities…

JB Exploit — Gateway-Driven `sell → PoolBurn(pool) + sync()` AMM-Reserve Drain (Venus-leveraged)

Loss · 49,958.06 USDT — drained from the JB/USDT PancakeSwap pair via the JB gateway (BSC; 18-de…

1. The attacker takes a free WBNB flash loan of 417,464.10 WBNB from a permissionless flash lender (output.txt:1646), supplies all of it to Venus as collateral (vWBNB.mi…

LBP (Little Boy Plus) Exploit — Reserve-Manipulated LP-Credit Inflates Mining Rewards Minted Into the Pool

Loss · 610.56 BNB total (≈ 592.41 BNB to the profit receiver + 5 BNB builder tip + gas/dust). Ne…

1. LBP is an immutable ERC-20 whose mining/hashrate accounting lives in a sibling contract LBPHashrate. Adding LP to the LBP/USDT pair grants the LP source hashrate, and…

Lixir vault `permit` signature bypass — any holder's vault shares drained with a forged signature

Loss · 2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX (≈ $33k at the time)

Lixir is a Uniswap-v3 active-liquidity manager. Users deposit into a per-pair vault (an ERC-20 "Lixir vault token", lv_X-Y A/B) and the vault parks the liquidity inside…

NovaBox Exploit — Stale Dividend Checkpoint on Join + Constructor `extcodesize` Bypass

Loss · 56.73 ETH drained from the NovaBox dividend pot (~56.729621359923131444 ETH net profit as…

1. NovaBox is a 2018-era "ETH+NOVA dividend box" written in Solidity 0.4.25. Depositing ETH or NOVA levies an 11% fee; the fee is distributed to existing dual-asset depo…

Ocean Protocol BPool / SideStaking gulp drain — pool internal records desynced from real token balance, harvestable via single-sided joins + exits

Loss · ~127,861 mOCEAN (minter-share / vesting token; attacker ends with 127,861.011180850512933…

Ocean Protocol runs a fork of Balancer's BPool (contracts/pools/balancer/BPool.sol) wired to a SideStaking helper (contracts/pools/ssContracts/SideStaking.sol). Each poo…

OLPC Exploit — Owner `decimalsValue` Misconfig Amplifies Pair-Side Burn → `amountIn=0` Supporting-Fee Drain

Loss · ~1,115,903.66 USDT drained — the OLPC/LABUBU pair's LABUBU reserve was routed out through…

1. OLPCToken overrides ERC20 _update (OLPCToken.sol:1403-1481). When OLPC leaves the PancakeSwap pair (from == swapPair), the hook burns value decimalsValue OLPC out of…

RoyalRoyalties Exploit — Zero-Amount ERC-1155 Batch Transfer Inflates `tierBalanceOf` 100×

Loss · 261,162.93 USDC — drained from the Royalties payout float on Polygon

1. Royal1155LDA is an ERC-1155 that keeps a custom per-tier balance ledger (_BALANCES_[tierId][owner]) on top of standard ERC-1155 balances. The Royalties contract reads…

Thetanuts Exploit — Zero-Cost Index-Vault `mint()` via Rounding-Down Component Deposits

Loss · 105,471.50 USDC drained (plus residual AVAX/BNB/MATIC component-vault shares forwarded to…

1. The Thetanuts index vault is an "index of vaults": one index share is backed by a pro-rata basket of component vault shares (BTC-USD, ETH-USD, AVAX-USD, BNB-USD, MATI…

Thetanuts Finance Exploit — Integer-Division Truncation in `mint()` After the Vault Is Drained to ~0 `totalSupply`

Loss · ~$2.1M real-world (≈$2M rescued by a whitehat per the post-mortem). The reproduced PoC re…

1. The vault is a basket-share token: holding one share entitles you to a pro-rata slice of five underlying option tokens. mint(amount) is supposed to pull a deposit of…

TOP Exploit — Aragon Instant-Execution Governance Self-Mint + Balancer BPool Drain

Loss · 944.195477215074054197 WETH (~944.20 WETH) drained from the Balancer TOP/WETH BPool; atta…

1. TOP governance is built on Aragon: an AppProxyUpgradeable-fronted Voting app whose execution scripts run with the TokenManager's MINT_ROLE, plus a TokenManager exposi…

Vault4626 — Donation of Non-Asset WETH Inflates totalAssets() and Is Paid Out on redeem()

Loss · ~13.53 WETH profit (18366634484619156667 − 4837426434749649311 = 13529208039869487356 wei)

1. totalAssets() (Vault4626.sol:496-536) returns idle USDC + LP value plus TWAP-quoted vault balances of the non-asset token (WETH):

WHALE Exploit — Flash-Inflated AMM Reserve → Mining-Hashrate Over-Credit Drain

Loss · ~$3,460 — 3,460.42 USDT forwarded to the attacker EOA after repaying every borrow (output…

1. WHALE is a deflationary BSC token bolted onto a "mining / hashrate" reward engine. Adding liquidity to the WHALE/USDT pair credits the LP-adder a hashrate balance in…

Adshares Bridge Exploit — Compromised Minter Key Fabricates Cross-Chain Mints

Loss · ~$628K — 1,199,999.81 wADS minted from nothing (3 fake "wrap" mints)

WrappedADS is the Ethereum side of the Adshares cross-chain bridge. The native ADS chain is supposed to be the source of truth: a user locks ADS natively, an off-chain r…

AROS Exploit — Leaked `claimSigner` Key + AMM-Reserve Drain via Signed Claims

Loss · ~$295,314 — 295,314.04 USDT drained from the AROS/USDT PancakeSwap pair (the pool's entir…

AROS is a UUPS-upgradeable ERC20 with an EIP-712 signed claim system. Four claim entry points (claimPrincipal, claimYield, claimLucky, claimContribution) let a user pull…

Aurellion Labs Diamond Re-Init Drain — Unprotected `initialize` → `diamondCut` pull/sweep

Loss · 456,442.536622 USDC (~$456K) to attacker EOA

1. Users had granted unlimited USDC allowances to the Aurellion diamond 0x0adc…. That alone is normal; the bug is that the diamond’s ownership / init surface remained op…

BlastFOMOVault `claimBonus` clone-churn drains BNB bonus pool

Loss · 1.289508079648543283 BNB offline (historical on-chain ~1.288418562948543283 BNB)

1. BlastFOMOVault turns buy-tax BNB into a decaying hype meter. When hype crosses threshold, Blast Mode opens and anyone can call claimBonus(referrer). 2. Each successfu…

BoostHook Leveraged Long Exploit — Spot open without post-open solvency + `MAX_LIQS_PER_BLOCK` cascade cap

Loss · ~20.9329 WETH attacker profit; ≥38.327 ETH realized totalBadDebtETH; ~34.9 ETH residual o…

1. BoostHook is a Uniswap v4 hook that lets users open leveraged long positions: user posts ETH collateral, the hook borrows more ETH from bonding-curve bands, swaps col…

DxSale Liquidity-Locker Exploit — Stealthy Ownership Takeover + Privileged Drain (~$7.3M BNB)

Loss · ~$7.3M in BNB across 1,400+ locked LP positions (per public post-mortems)

DxSale's liquidity lockers are custodial: users send their LP tokens to a locker contract and trust the contract to refuse withdrawals until each user's timelock elapses…

Ekubo Protocol Exploit — Flash-Accounting `pay()` Funded From a Victim's Standing Approval

Loss · ~$1.4M — 17.0 WBTC (1,700,000,000 at 8 decimals) drained from a single approving user

Ekubo is a singleton-style concentrated-liquidity DEX (the "all the tokens live in one Core contract" design, like Uniswap V4). All interactions happen inside a flash-ac…

ElevateFi Exploit — Fixed-USD Staking Packages Priced from Spot DAI/EFI Reserves

Loss · ~$16,000 — 6,264.86 EFI paid out of the ElevateFi staking vault (asserted profit 62648645…

1. ElevateFi's staking implementation lets a user open a fixed-USD package (e.g. package 7 = $25,000) by calling stakeEFI(packageId) (Staking_Implementation.sol#L1575-L1…

Fractal Protocol Exploit — Stale-Price / Retroactive-Yield Arbitrage via Permissionless `compute()`

Loss · 13,707.72 USDC.e (13,707,715,574 raw, 6 dp) — ≈ $13.7K, the entire withdrawal buffer + ac…

Fractal's Vault is a yield-bearing wrapper: you deposit() USDC.e and receive USDF receipt tokens priced at an internal tokenPrice (≈ how many USDC.e one USDF is worth).…

HeisenbergHook Fee Path Hijack — Unrestricted `poolKey` overwrite + permissionless `processFees`/`processBurn`

Loss · 0.425919592403168892 ETH attacker profit (gas-free PoC; on-chain net after ~0.0044 ETH ga…

1. HeisenbergHook is a Uniswap v4 hook for the $HEIST / ETH pool. Sell-side fees accumulate as pendingFeeHEIST (~5,261 HEIST pre-attack); buy-side fees split into treasu…

Huma Finance Exploit — Evaluation-Agent Approval Bypass via `refreshAccount()`

Loss · ~$101,390 — 82,315.571243 USDC + 19,074.730601 USDC.e drained from three Huma credit pool…

1. Huma Finance runs on-chain credit pools where large credit lines are supposed to be gated behind a privileged off-chain underwriter, the Evaluation Agent (EA). Only t…

INK Finance Exploit — Flash-Loan-Inflated, Permissionless `claimPayroll()` Treasury Drain

Loss · ~$140,180 — 140,180.175562 USDT0 (the treasury's entire balance)

INK Finance is a Polygon "on-chain payroll / DAO treasury" product. Employees are paid out of a shared Treasury vault. The Payroll contract exposes claimPayroll(uint256…

Joe Agent (JOE) Exploit — `removeLiquidityViaContract` Reentrancy on Pooled LP Custody

Loss · ~$45K — 62.5 BNB + 1,848,087 JOE drained from the protocol's pooled LP

JoeAgentToken lets users "zap" native BNB into a JOE/WBNB LP position that is custodied by the token contract itself and merely credited to the user via lpInfo[user].lpA…

LegendaryMoneyMonNft Exploit — `cliamRewred()` Signature Bypass via `ecrecover` → `address(0)` == `admin`

Loss · ~$85,519 — 24,306.53 MON drained from the NFT contract, swapped to 85,519.47 USDT

LegendaryMoneyMonNft.cliamRewred() lets any caller pull an arbitrary ERC20 amount out of the contract, gated only by an off-chain admin signature checked through verify(…

MAP Protocol Exploit — Unverified `retryMessageIn` Forges a Cross-Chain Message to Mint 1e33 MAPO

Loss · ~$180K — 1,000,000,000,000,000 MAPO (1e15 MAPO = 1e33 wei) minted out of thin air to the…

MAP Protocol's OmniService bridge (MOSV3) accepts inbound cross-chain messages through messageIn(...), which is gated by a light-client proof (lightNode.verifyProofDataW…

MetaSea (SEA Token) Exploit — `redeemPosition()` Over-Pays From an Unguarded Reward Distributor

Loss · ~$110K total across the attacker campaign — this single tx nets 13,904.94 USDT and drains…

MetaSea is a USDT "IDO / staking round" product. A user calls openPosition(usdtAmount, …) to deposit USDT; the MetaSea Round contract buys SEA, records the position, and…

Mure Distribution Exploit — Attacker-Controlled `source` Forges Both Verifier and Signature

Loss · ~5.45 ETH (≈ 4,848,683.8 QUEST drained from the victim, swapped to 5.4511 WETH)

MureDistribution is meant to let a user redeem a "distribution" of ERC-20 tokens that was authorized by a trusted pool's signer. The flaw is that nothing about the autho…

New Market Trading Exploit — Payload-Forgery Drain via Axelar "Express" Path on a Gnosis Safe Module

Loss · ~$3.98M total across 88 Gnosis Safes on Ethereum / Base / Arbitrum. This PoC drains one E…

SquidRouterModule is a Gnosis Safe module that lets a Squid/Axelar cross-chain message drive swap/approve actions on a Safe that has installed the module. It inherits Ax…

ONTR Token Zero-Owner `onlyOwner` Free Mint → Pancake WETH Drain

Loss · 49.480100697512152261 WETH (exact wei: 49480100697512152261)

1. ONTR ships a custom Ownable whose onlyOwner is: When ownership has been renounced (owner == 0), any caller is treated as owner.

Renegade Darkpool Exploit — Re-Initializable Proxy → Attacker-Controlled `delegatecall`

Loss · ~$210K — 26 ERC-20 tokens drained from the Darkpool. Largest: 104,383.59 USDC + 0.3466 WB…

The Renegade Darkpool is an upgradeable proxy whose logic lives in an Arbitrum Stylus (Rust) implementation. Its initialize(...) function — which records core protocol a…

Sat1Hook Forensics — Grindable Hook Identity, but No Confirmed Protocol Loss

The initially supplied transaction is not a Sat1Hook drain. It is an MEV backrun placed immediately after a large, ordinary curve redemption. The backrun contract gained…

Sharwa Margin Trading — Uniswap-V3 spot-price oracle used to value NFT collateral

Loss · ~32.85K USDC (32,850 USDC, 6 decimals)

Sharwa's margin-trading protocol accepts ERC-721 collateral (here a Hegic option NFT, tokenId 16129) and values it through a "UniswapModuleWithoutChainlink" module. That…

SKP Token Exploit — Owner Backdoor `ownerBurnLiquidityPairTokens()` Reserve Drain → Collateral Price Inflation

Loss · ~$212K USD — BTCB + USDT borrowed against artificially-inflated SKP collateral on Venus/L…

SKP is a fee-on-transfer "deflationary" BSC token whose owner retained a hidden backdoor: ownerBurnLiquidityPairTokens(uint256) (selector 0x4eb9b26d). When called by the…

SKP/USDT Exit-Scam Drain — Pre-Positioned 96.8%-of-Supply "Whitelist" Treasury + Pool Drain

Loss · ~$212,195 USDT on-chain / +233,967.42 USDT net in this PoC (no flash-loan fees) — the SKP…

This is not a conventional external hack — it is an exit scam with a vulnerability-shaped cover story, and the on-chain record proves it. Three facts establish that the…

SQ Token Staking Exploit — Hardcoded Owner Backdoor + Self-Minting Staking Rewards

Loss · ~$346.1K — 346,137.03 USDT drained from the staking contract and its SQi/USDT pool

Staking is an Ownable-derived staking/MLM contract. Its _checkOwner() was modified away from the standard OpenZeppelin implementation to add a second, hardcoded address…

Squid Router Module Exploit — Caller-Supplied Delegate on the Permissionless Axelar Express Path

Loss · 0.25361701 WBTC + 0.293599251 wTAO + ~0.0221 ETH (wrapped) + 0.000000000000001215 WETH —…

1. SquidRouterModule is an enabled module on a Gnosis Safe. It can drive the Safe (execTransactionFromModule) to approve tokens and route swaps — but only after it check…

TesseraSwap Exploit — CEI Violation: Treasury Pays the Output Token Before Collecting the Input Token

Loss · 13,065,334 USDC (6-decimals raw) ≈ $13.07 of USDC siphoned from the Tessera treasury per…

1. TesseraSwap.tesseraSwapWithCallback (src_TesseraSwap.sol:46-65) is a router-style swap: a caller specifies (tokenIn, tokenOut, amountSpecified, …), an off-chain "Tess…

TrustedVolumes Exploit — Permissionless Signer Registration + Wrong-Key Authorization Drains an RFQ Settlement Proxy

Loss · ~$5.87M USD — 1,291.16 WETH + 206,282.45 USDT + 16.939 WBTC + 1,268,771.49 USDC drained f…

TrustedVolumes runs an RFQ (request-for-quote) settlement proxy. A signed order says: a maker gives makerAmount of makerAsset, a taker gives takerAmount of takerAsset. T…

Verus–Ethereum Bridge Exploit — Forged Cross-Chain Import With No Source-Amount Validation

Loss · ~$11.58M — 1,625.367 ETH + 103.568 tBTC + 147,658.84 USDC drained from the bridge's Ether…

Verus is a PBaaS blockchain whose Ethereum bridge lets users move value between Verus and Ethereum. To release funds on Ethereum, the bridge requires a cross-chain impor…

WUSD Exploit — Sybil-Farmable `_englove()` Reward Mint + Thin-Pool GLO Drain

Loss · Reported ~$200K-class incident (free GLOVE emissions + LP drain across the on-chain campa…

WUSD.wrap() mints WUSD against a stablecoin (USDT/USDC) and, as a reward, calls the internal _englove() routine to mint free GLOVE (contracts_WUSD.sol:309-318).

YSDAO Exploit — Balance-vs-Reserve "Add/Remove Liquidity" Tax Bypass + Permissionless `Staking.sync()` Price Pump

Loss · ~19,490.91 USDT (≈ $19.49K) extracted from the YSDAO/USDT PancakeSwap V2 pair

YSDAO is a "fee-on-transfer" token. To avoid taxing legitimate LP mint/burn, its transfer hook tries to guess whether a pair-side transfer is a buy, a sell, an add-liqui…

a152 Authorized-Spender Allowance Drain — privileged spender abused to pull any user's approved tokens

Loss · 228,980.735023 USDT drained and consolidated to the attacker (PoC figure, output.txt:1565…

The victim was an aggregator/spender deployment built on the well-known "AllowanceTarget + SpenderHelper" pattern (identical addresses to 0x Exchange Proxy infra: Allowa…

Blockchain Bets ERC-1155 stake/transform inflates redeemable BCB → UniV2 dump

Loss · 17.568954659981801955 ETH (exact wei: 17568954659981801955)

1. Attacker CREATE-deploys a nested factory at nonce 0 that flash-swaps 4_000_000_000 raw BCB (9 decimals) from the UniV2 BCB/WETH pair. 2. Flash funds are split across…

Giddy YieldBasis VaultV3 — EIP-712 signature only binds swap `data`, not token/amount/aggregator

Loss · ~$1.3M (in three YieldBasis gauge receipt tokens: ~3.53 g(yb-tBTC), ~6.94 g(yb-cbBTC), ~6…

Giddy's YieldBasis vaults (a tBTC, a cbBTC, and a WBTC vault, all sharing the GiddyVaultV3 implementation) compound their strategy rewards through a signed VaultAuth mes…

JUDAO sell-hook reserve drain — token transfer hook burns liquidity directly from its own DEX pair, desyncing the AMM reserves the attacker then arbitrages

Loss · 205,259.49 USDT + 36 BNB (≈ $62k at the time)

JUDAOToken overrides _update (ERC-20 transfer) to install a buy-mining / sell-deflation economy on top of its PancakeSwap JUDAO/USDT pair. The sell branch, entered when…

Juicebox REVLoans Exploit — Trust-on-First-Use of a Caller-Supplied Loan Source Inflates Borrowable Surplus

Loss · ~21.76 ETH — 21.764969886576733610 ETH drained from Juicebox revnet #3's treasury via JBM…

1. REVLoans.borrowFrom() (src_REVLoans.sol:483-560) lets anyone open a loan against a revnet, passing a REVLoanSource{token, terminal} struct of their own choosing. The…

Kipseli PropAMM Exploit — USD-Scale Quote Misread as cbBTC Token Units

Loss · 0.92610395 cbBTC (raw 92,610,395, 8 decimals) drained from a Kipseli-controlled cbBTC hol…

1. PropAMMWrapper.swap(tokenIn, amountIn, tokenOut, minOutAmount, recipient) (src_PropAMMWrapper.sol#L34-L41) is a thin front-end to an external "PropAMM" pricing engine…

MONA / LisaVault Exploit — Self-Referral Node Farming + Insider LP Drain

Loss · 20,357.8 USDT net to the attack contract + 10,000 MONA dividends, sourced from (a) 25,831…

LisaVault sells "nodes." Each node:

PerpPair Exploit — Self-Dealt LP/Trader Pair Inflates Curve-Priced PnL out of the Shared Vault

Loss · 165,617.735181 USDC net profit asserted by the PoC (the real-world incident is quoted at…

PerpPair is a perpetuals AMM. Liquidity providers and traders both post USDC into one shared Vault; profit and loss are settled against that single pool. A position's Pn…

QNT Reserve EIP-7702 + Permissionless `BatchCall.batch()` Drain

Loss · 1,988.546547972979064297 QNT (exact wei: 1988546547972979064297) → swapped to ~54.93 ETH

1. A QNT reserve is controlled under the authority of admin EOA 0xc6ddf907…. 2. That EOA is EIP-7702-delegated to BatchExecutor 0x95538e1c… (designator code 0xef0100 ||…

RWAVault Exploit — Overridden `ERC4626.withdraw` Drops the Allowance Spend

Loss · 398,655.47 USDC total vault outflow (392,763.999994 USDC principal pulled to the attacker…

1. RWAVault is an ERC4626 "real-world-asset" vault that custodies depositors' USDC, mints them shares, and pays monthly interest. At maturity, depositors call withdraw/r…

Saturn Protocol (sUSDat) — Withdrawal Freeze via `strcBalance`/`vestingAmount` Desync + 33% PROCESSOR Extraction

StakedUSDat tracks two pieces of accounting that must stay coupled but are updated by different functions:

sAVAX Rebalancer arbitrary-call drains victim credit delegation — permissionless `target`/`data` execution from a delegated Aave borrower

Loss · 6,999.99 WAVAX (~7,000 AVAX) [output.txt:1565]

The "sAVAX Rebalancer" (0x7A7b…a8C9) is a contract that helps users grow their leveraged Aave V3 sAVAX position. To do so it borrows WAVAX from Aave on behalf of the use…

Singularity dynBaseUSDCv3 Exploit — `totalAssets()` Inflation via a Mis-Configured (Fee-Tier-42 / Zero-Liquidity) Oracle Path

Loss · ~$413,132 — 413,132.022315 USDC drained from the vault's reserves, plus ~31,174 residual…

PermissionedDynaVault (deployed as dynBaseUSDCv3) is an ERC-4626-style multi-asset vault. Its totalAssets() sums the USDC value of every reserve token, pricing each non-…

Squid `SquidMulticall` Exploit — Arbitrary-Target `Default` Call Turns an Approved Multicall into a Universal `transferFrom` Proxy

Loss · 1.0 ETH (Binance-Peg ETH, 0x2170…33F8) drained from the victim in the reproduced transact…

1. SquidMulticall.run(Call[] calls) (contracts_router_SquidMulticall.sol#L18-L48) is a fully permissionless entry point: it iterates over a caller-supplied array of Call…

SubQuery (SQT) Exploit — Unprotected `Settings.setBatchAddress()` Role Hijack

Loss · 218,070,478.035174175990999309 SQT (~218.07M SQT) transferred to the attacker, plus a 0.1…

1. SubQuery routes every privileged-role lookup through a single Settings registry. The Staking contract decides "who is allowed to call me" by reading settings.getContr…

Thetanuts BTC/USD Vault Exploit — ERC4626-Style First-Depositor Share Rounding at `totalSupply() == 0`

Loss · 0.15177162 WBTC (15,177,162 sats) drained from the Thetanuts BTC/USD vault's pre-existing…

1. The Thetanuts BTC/USD covered-call vault at 0x80b8EEb3… was in a degenerate state: it held 15,179,557 sats of WBTC (output.txt:1592) while its totalSupply() was 0 (ou…

TTSwap Market: permissionless `initGood` + attacker-controlled ERC20 skews AMM accounting via `buyGood`/`payGood`

Loss · 5.098626217469779632 ETH (exact PoC / on-chain profit after 8 WETH Balancer repay)

1. Attacker CREATE-deploys a factory (nonce 0) that spawns a child exploit and a fake ERC20 good (spoofed transfer/balanceOf). 2. Child flash-loans 8 WETH from Balancer,…

Victim automation `execute()` missing auth drains yvWETH via Yearn withdrawal path

Loss · 429.210570004163139903 ETH (exact internal transfer / PoC profit)

1. Victim EOA holds ~384.667 yvWETH and grants max allowance to a personal automation at 0x143A…181A. 2. Automation exposes execute((uint8,bytes)[]) (selector 0x49650044…

xLOOT Staking Exploit — Duplicate NFT IDs in `redeem(uint256[])` Claim the Same Epoch Reward Repeatedly

Loss · 6.21 ETH total in the live incident; the extracted PoC nets 4.110409994732514492 ETH prof…

1. xLOOT stakers earn a weekly epoch reward. Each xLOOT NFT can claim a fixed earning-per-NFT (epn) for every epoch it has not yet redeemed. A per-NFT cursor xloot.nextR…

AlkemiEarn Exploit — Self-Liquidation Storage-Aliasing Collateral Duplication

Loss · 43.4540 ETH (~$43.45k+ at the time) drained from the AlkemiEarn WETH market

AlkemiEarn is a Compound-style money market (a hard fork of Compound v1 era code). Its liquidateBorrow (AlkemiEarnPublic.sol:3444) lets a liquidator repay an underwater…

ATM BlindBox predictable fallback RNG — attacker evaluates settlement seed before calling `settle`

Loss · ~13,000,000 ATM (~$99,000) reported; single attacker bet realized 285,000 ATM net profit…

BlindBox is a binary odd/even betting game attached to the ATM token. A user burns ATM to the 0x…dEaD address, the entry hook onBlindBoxEntry records a bet with the user…

BCE `scheduledDestruction` drain — token transfer hook burns LP reserve tokens then `sync()`s the pair

Loss · ~800,000 USDT (BCE/USDT pair drained to 259,506 wei of USDT; attacker realizes ~680,000 U…

BCE is an ERC-20 with a deflationary "scheduled destruction" mechanism: every sell into the BCE/USDT PancakeSwap pair adds value per 10 / 100 BCE to a global scheduledDe…

Curve LlamaLend (Inverse Finance sDOLA market) Exploit — Oracle / Band Manipulation Mass-Liquidation

Loss · ~$240,000 — extracted as 227,325.57 DOLA + 6.94 WETH

Curve LlamaLend is a lending market where collateral is continuously, automatically "soft-liquidated" inside a specialised AMM (LLAMMA) as the collateral price falls: as…

DayContract / Polarx — Spot Manip + Rigid Principal Guarantee

Loss · ~$10.6K attacker profit; ~$29.7K protocol insolvency

DayContract.deposit converts USDT → LP via Pancake spot reserves (no TWAP). withdraw always calls vault.settlePrincipal(user, fullPrincipal, 0), and the vault’s _ensureU…

EST / BNBDeposit Exploit — `skim()`-Fed Proportional Reward Drain + AMM Reserve Manipulation

Loss · 150.16 WBNB (~150.2 WBNB per the incident header) — the entire WBNB reserve of the EST/WB…

BNBDeposit is a referral/LP-staking contract for the EST token. When a user transfers exactly 1 EST to it, the EST token calls back BNBDeposit.onTokenReceived(), which p…

InfinitySix — Stale 1-min TWAP + Instant Referral Bonus Over-Mint

Loss · ~$273.8K USDT attacker profit (PoC net ~$277.2K without flash fees)

invest() immediately credits the sponsor with directBonus += 5% of the invest amount. withdraw() pays that USDT-denominated bonus in i6 tokens priced by twapPrice, but u…

Linea TokenBridge upgrade — permissionless reinitialization drains locks

Replacing an inherited initializer changes the storage layout. The live bridge appears uninitialized, letting an arbitrary caller become admin, install an attacker messa…

Movie Token (MT) double-count burn — BSC Mar 2026 ~$242K

Loss · ~$242K (~381.7 WBNB)

Myriad CLOB — free YES tokens when cross-market `priceSum > ONE`

1. Cross-market match requires only priceSum >= ONE, not equality. 2. Maker notionals sum with round-down; taker pays max(0, fill - notionalSoFar). 3. When priceSum > ON…

Old CheckoutPool Bridge Operator (`_ALLOW_ALL_`) — permissionless bridge() routed an ERC-4337 paymaster into draining CheckoutPool's USDC excess

Loss · 85,730 USDC (85,729 from CheckoutPool._POOL_EXCESS_ + 1 USDC held by the checkout)

CheckoutPool is an ERC-4337 (account abstraction) payments pool: users register a "checkout" (a desired on-chain payment, e.g. pay 85,730 USDC to a recipient), lock up f…

Parallel 3.1 — processSurplus always reverts for managed collateral

1. Managed collateral lives on an external manager/strategy, never on the diamond. 2. getCollateralSurplus correctly uses manager.totalAssets(). 3. processSurplus self-s…

Revamp referral-reward drain — a self-referral that pays contributors out of existing pool BNB

Loss · 2.99 BNB (3.2078 BNB was the contract's entire native balance; ~2.9898 BNB is net attacke…

Revamp is a "revamp" / contribution protocol on BSC. Anyone can pay a listing fee to register an ERC-20, after which users call revamp(token, tokenAmount, referral) to s…

Sablier Bob Escrow — Adapter vault `_userWstETH` not cleared after redemption enables theft of other users' funds

1. Adapter vaults track each user's staked amount in _userWstETH. 2. On redeem, shares are burned and WETH is paid from calculateAmountToTransferWithYield — but _userWst…

Sablier Bob Escrow — Circular slippage protection in `SablierLidoAdapter::_wstETHToWeth` enables sandwich attacks

1. _wstETHToWeth sets minEthOut from Curve get_dy (current reserves). 2. exchange reads the same reserves — so a sandwich that depresses the pool makes both quote and sw…

StakeOnMe JAKE owner-wrapper reserve asymmetry — public owner-privileged mint vs. burn pays out against an inflated ETH reserve

Loss · 0.28 ETH (≈ 0.2793 ETH net to attacker; 1.919 ETH drained from the wrapper pool)

The JAKE meToken (0x277697FA…, a Bancor-style bonding-curve token) is governed by an unverified public contract at 0x237d…4b3f that the meToken reports as its owner() [o…

Univ3CollateralToken — Uni V3 position counted as collateral for every vault owned by the same minter

Loss · ~57,000 USD (USDC + USDC.e drained from the USDI reserve)

Univ3CollateralToken is the Uni-V3-position collateral adapter for a lending system (USDI / VaultController). When a user deposits a Uni V3 NFT into a vault, the contrac…

Venus (vTHE) Exploit — Donation-Inflated Exchange Rate + `borrowBehalf` Drains a Victim's Pre-Approved Delegate

Loss · 913,858.26 CAKE + 1,972.53 WBNB borrowed onto the victim's account and walked off by the…

Venus is a Compound-V2 fork. A vToken's collateral value is vTokenBalance × exchangeRate × price × LTV, and the exchange rate is computed as

VTSwapHook reserve/fee accounting divergence — Uniswap V4 custom-curve hook books full specified amount into reserves while pricing output on the fee-reduced input

Loss · 4,507,034.03 vATH + 2,007,935.14 ATH (per @KeyInfo)

VTSwapHook is an Aethir-style vesting-token (VT) swap pool built as a Uniswap V4 custom-curve hook (beforeSwapReturnDelta = true). Instead of using V4's concentrated-liq…

Whalebit Oracle Manipulation Exploit — Spot-Priced Level Staking Round-Trips a Manipulable Algebra Pool

Loss · 9,745.17 CES net intra-transaction profit (150,701.56 − 140,956.39 CES), drained out of W…

1. Whalebit sells fixed-size "levels". A user calls staking.deposit(level) and pays a fixed CES sticker amount for that level (level 12 = 6,426.84 CES, returned by level…

WUKONG Staking — classical reentrancy in `unstake()` drains pooled LP

Loss · ~57.68 BNB (~$37.7K) on the main tx (attacker EOA net gain); a second tx drained ~$18K

StakingUpgradeableV10.unstake() returns the withdrawer's BNB with a raw payable(msg.sender).call{value: bnbReceived}("") before it closes the position (isStaking = false…

Xocolatl AccountLiquidator — arbitrary caller-supplied HouseOfReserve zeroes the liquidation cost

Loss · 3.25 cbETH + 0.22 WETH (≈$11.2k at the time)

Xocolatl is an over-collateralized CDP system on Base: users deposit cbETH/WETH into a HouseOfReserve, receive a minted (backed) token as debt, and can be liquidated thr…

FoomCash / FOOM Lottery — Groth16 verifier with `gamma == delta` lets anyone forge proofs

Loss · 19,695,576,757,802.19 FOOM (~$1.3M) — the FOOM Lottery pool drained to dust in one tx

1. FoomCash's FoomLottery is a Tornado-style shielded pool: you play() to deposit FOOM behind a commitment, and later collect() a reward by presenting a Groth16 zero-kno…

LAXO Token Exploit — Uncompensated Pool-Side Burn on Every Sell Breaks `x·y = k`

Loss · ~137,320 USDT (BSC-USD) drained from the LAXO/USDT PancakeSwap pair

LAXOToken is a deflationary "tax token." Whenever someone sells (transfers LAXO to the PancakeSwap pair), its _transfer override doesn't just tax the seller — it burns u…

Moonwell cbETH Oracle Incident — Mispriced Collateral Enables Near-Free Liquidation

Loss · ~$1.78M protocol-wide bad debt (cbETH $1.03M, WETH $479K, USDC $233K, EURC, cbBTC, cbXRP,…

Moonwell (a Compound-v2 fork on Base) values collateral and debt for liquidations through its ChainlinkOracle. For cbETH that oracle reads a ChainlinkOEVWrapper, which i…

XDK Exploit — Sell-Path "Recycle" Removes XDK from the Live Pair and `sync()`s

Loss · ~6.84 WBNB — 6.840316534082275362 WBNB (~$3–4K) forwarded to the attacker EOA, sourced fr…

1. XDK is a fee-on-transfer "deflationary + dividend" token on BSC. Its uniswapV2Pair is the live XDK/GPC PancakeSwap pair (GPC, ticker for the AMMToken contract, is the…

2026-01 Sparkle! (SPRK) Tobin-tax self-transfer inflation

Loss · ~$14.6K (alerter); PoC ~4.5 ETH net at attack-block reserve

FutureSwap Perpetual Drain — Fee Unit-Mismatch (`addFee` token-units interpreted as bps/share)

Loss · ~394,742.852305 USDC.e net attacker profit; victim drained of 197,436.748947 USDC.e of st…

FutureSwap is a perpetual-swap engine. A user calls changePosition(deltaAsset, deltaStable, stableBound) to open/close/resize a position; the engine swaps the asset leg…

Majority Protocol — free cross-game participation via unbound questionId

commitReaction only checks the caller joined _gameId, then forwards an arbitrary _questionId to the prompt strategy. Reactions are stored by questionId alone, so a free-…

Majority Protocol — multi assertResults causes bond loss for all but first

assertResults is permissionless and accepts multiple bonds for the same sessionId. The first successful recordResults fills winners[sessionId]; the second reverts Winner…

Majority Protocol — re-join after leave permanently locks second entry fee

After leaveRescheduledGame sets hasRefunded[gameId][player]=true, _payEntryFee on re-join never clears that flag. When the game is later cancelled, refundCancelledGame r…

Majority Protocol — refundCancelledGame missing join check

SessionManager.refundCancelledGame only checks that the game is Cancelled, then refunds ticketPrice to msg.sender without verifying contestants[gameId][msg.sender]. An a…

Majority Protocol — start without ranked rewards locks prize pool

FixedRanksReward.setRankedRewards (and ProportionalToXPReward.setNumberOfWinners) require Created state, but the game can start and conclude without them. claimRewards t…

Majority Protocol — start without XPTiers yields zero unclaimable rewards

setXPTiers is only allowed in Created, but the game can start without tiers. XP computation yields 0; ProportionalToXPReward then produces zero rewards and _distributeRe…

Makina Finance Exploit — Self-Referential AUM Oracle Manipulation via Permissionless Re-Accounting

Loss · ~$5.1M USDC drained from the DUSD/USDC pool (PoC reproduces $4,304,016 net profit over tw…

Makina is an on-chain asset-management vault. Users deposit USDC and receive DUSD (the MachineShare token). DUSD's "fair value" is the vault NAV per share: lastTotalAum…

MT Token Exploit — Fee-on-Transfer Overcharge Drains the AMM Pair via `skim()`+`sync()`

Loss · ~36,995.24 USDT net pool loss (gross USDT pulled from pair: ~226,722.24 USDT, the rest re…

MetaverseToken (MT) is a fee-on-transfer ERC20. On a normal transfer it takes a 5% fee (transactFeeValue = amount × 5 / 100) and is supposed to split that 5% among three…

PRXVT Staking Exploit — Transferable Reward-Receipt Token Resets `userRewardPerTokenPaid`

Loss · ~32.8 ETH (drain of the PRXVT staking reward reserve; reward reserve at the fork block ≈…

PRXVTStaking is a Synthetix-style staking contract whose receipt token stPRXVT is a plain, freely-transferable OpenZeppelin ERC20 (the contract is ERC20). Rewards are ac…

Statusl — bypass stake lock via leave + migrateToVault

1. Stake with a multi-year lock for max multiplier. 2. leave() zeros stakedBalance but does not permanently ban the vault as a migrate target. 3. An empty vault migrates…

Statusl — global MP cap broken on unstake causes permanent DoS

1. Protocol assumes totalMPAccrued totalMaxMP.

SynapLogic Exploit — Uncapped Cumulative Refunds in the Token Sale `buy` / `swap` Path

Loss · ~27.65 ETH (ETH attack) + ~3,450 USDC (USDC attack) — entire sale-contract balances; a th…

The SynapLogic presale lets a buyer purchase the project token while nominating a list of referral / refund recipients, each receiving some percentage of the buyer's own…

Truebit Exploit — Inverted `getPurchasePrice` Lets Anyone Buy TRU For Free, Then Sell For ETH

Loss · 8,539.41 ETH drained from the bonding-curve pool (the PoC starts with 1 ETH and ends with…

Truebit's bonding-curve pool prices TRU purchases with a function getPurchasePrice(amount) whose arithmetic is inverted: instead of returning numerator / denominator, it…

AmpleEarn — unrestricted router allows unauthorized merkle root setting

Router batchSetMerkleRootsStrict has no auth; vault setMerkleRoots authorizes msg.sender, which is the router when not routed through EVC

Monolith — free-debt rounding allows unbacked borrow

1. Free-debt share math rounds personal debt up. 2. Redeem + debase loops inflate freeShares / freeDebt; residual shares can survive after the last free-debt wei is repa…

Panoptic — commission fees can always be bypassed

1. settleBurn takes commission = min(premiumFee, notionalFee). 2. _settleOptions passes long=short=amm=0 so notionalFee = 0 → commission 0. 3. If realizedPremium == 0 th…

Panoptic — cross-contract reentrancy converts phantom shares to real shares

1. Liquidation delegates type(uint248).max phantom shares on ct0 and ct1. 2. ct0.settleLiquidation refunds ETH to liquidator before ct1 is revoked. 3. Reentrant transfer…

Ribbon Finance MarginPool — corrupted oToken expiry prices via pricer proxy takeover

Loss · ~$2.7M

Legacy Ribbon/Opyn-style MarginPool held collateral for cash-secured call oTokens that expired OTM. The attacker temporarily took ownership of multiple asset pricer prox…

yETH Weighted-StableSwap Exploit — Invariant Rounding Drift Mints Unbacked LP

Loss · ~$9M — the pool's entire LSD reserve: ~2,587 ETH-equivalent across 8 liquid-staking tokens

The yETH pool is a Curve-style weighted stableswap whose invariant D (a.k.a. supply) is solved iteratively in _calc_supply() and whose per-asset terms use a rounded _pow…

Balancer V2 Exploit — ComposableStablePool Rounding-Error Drain via Rate-Scaled `_upscale`/`_downscale`

Loss · ~$120M total across many affected ComposableStablePools (BlockSec/SlowMist figures). This…

Balancer V2 prices every pool in 18-decimal fixed point. To do so it upscales raw token amounts by a per-token scalingFactor, runs StableMath on the scaled values, then…

DRLVaultV3 Exploit — Self-Referential Slippage Lets a Manipulated Pool Set Its Own "Minimum Out"

Loss · ~$100,000 — the vault's full 100,000 USDC balance, swapped for 0.0001205 WETH (≈ $0.43)

DRLVaultV3 is an automated Uniswap-V3 liquidity-management vault. To rebalance, it swaps USDC into WETH via swapToWETH(). That function is:

Megapot — Attacker can steal JackpotTicketNFTs from JackpotBridgeManager

_bridgeFunds calls _bridgeDetails.to with attacker-supplied calldata after optionally approving USDC. Pointing to at the ticket NFT and data at safeTransferFrom(bridge →…

Megapot — LP pool cap may be exceeded on drawing settlement

processDrawingSettlement computes newLPValue without the same pool-cap clamp used on deposits

Megapot — Unoptimized subset matches counting exceeds Base tx gas limit

_countSubsetMatches regenerates subsets for every bonusball. At bonusballMax=129 the settlement callback measures ~25.8M gas and exceeds Base's 25M per-tx limit, so Pyth…

Moonwell Exploit — Corrupted wrsETH Oracle ⇒ Borrow ~$88K Against ~$0.07 of Collateral

Loss · ~$1M total across Moonwell markets; the reproduced single transaction nets 24.92 WETH ≈ $…

Moonwell prices its wrsETH collateral with a ChainlinkCompositeOracle that multiplies an ETH/USD feed by a "wrsETH→ETH exchange-rate" feed (ChainlinkCompositeOracle.sol:…

stNXM — attacker profits by manipulating Uniswap liquidity via slot0

dexBalances reads Uniswap V3 slot0 spot price to value LP inside totalAssets

Accountable — `AccountableOpenTerm` interest cannot be repaid once principal hits zero

1. Interest accrues virtually via _scaleFactor / scaleFactor. 2. repay() only reduces outstandingPrincipal; excess for interest is optional. 3. When principal reaches ze…

Accountable — Cancelling redeem requests permanently blocks the withdrawal queue

1. Redeem requests sit in a FIFO queue keyed by nextRequestId (head). 2. Cancelling a request fully deletes the entry (controller = address(0)) without advancing the hea…

BaseSwapCallback Exploit — Public `uniswapV3SwapCallback` Approval Drain

Loss · ~55.51 WETH (~$220K) drained from a single approver

An unverified Base router-like contract exposes uniswapV3SwapCallback(int256,int256,bytes) without verifying that msg.sender is a real Uniswap V3 pool created by a trust…

BOB Staking — Bonuses obtainable without proper locking

1. First stake with lockPeriod = 0 sets unlockTimestamp = now and stores lockPeriod = 0. 2. Second stake with a long lock period still passes the consistency check (guar…

BOB Staking — Delegating to address(0) empties contract via alterGovernanceDelegatee

1. First non-zero delegation moves the staker's tokens contract → surrogate. 2. Setting delegatee to address(0) is allowed; tokens move to a zero surrogate. 3. Re-delega…

BOB Staking — instantWithdraw does not transfer amountForContract

1. Delegated stake lives in a DelegationSurrogate. 2. instantWithdraw pulls only _amountForUser from the surrogate. 3. _amountForContract (penalty) is never transferred…

Centrifuge v3.1 — pool managers steal other pools pending deposits

Spoke.requestCallback uses current requestManager without binding to the manager that created the request

Hybra Finance — Assets deposited before calculating shares to mint

1. deposit first moves HYBR into the voting escrow (increasing totalAssets). 2. Then shares = calculateShares(amount) uses the post-deposit total. 3. At 1:1 with 100 alr…

MIM Spell ("MIMSpell3") Exploit — Collateral-Free MIM Mint from Privileged Cauldrons

Loss · ~$1.7M — 1,793,766 MIM minted with no collateral, exited as 389.75 WETH

Abracadabra's CauldronV4 is the standard MIM lending engine: you cook() a sequence of actions — add collateral, borrow, repay, etc. A normal ACTION_BORROW sets a flag so…

Remora — `buyTokenOCP` signatures reusable forever (missing nonce)

1. buyTokenOCP verifies an EIP-712-style BuyToken(investor, token, amount) signature and skips on-chain payment. 2. The hash omits a nonce and nothing marks the digest a…

Remora — div-before-mul in `FiveFiftyRule::_updateEntityAllowance` exceeds caps

1. Allowance updates use (REMORA_PERCENT_DENOMINATOR / equity) amount. 2. Integer division truncates first → delta is smaller than DENOM amount / equity. 3. On the reduc…

Remora — resolveUser lock migration can be griefed to extend lock duration

1. resolveUser migrates locks by appending old locks after any locks already on newAddress. 2. availableTokens stops at the first unexpired entry. 3. A frontrun transfer…

Remora — unrestricted `SignatureValidator::setAllowlist` enables free `buyTokenOCP`

1. SignatureValidator.setAllowlist is external with no restricted / onlyOwner guard. 2. TokenBank inherits it, so anyone can point the bank at a MaliciousAllowlist whose…

Securitize DSToken — unapproved `transferFrom` theft

StandardToken.transferFrom calls its transfer primitive directly and never checks the owner's allowance for msg.sender. An arbitrary investor can therefore debit any oth…

Sequence — partial session-signature replay / frontrun (H-02)

1. Calls.execute bumps the nonce, validates the session signature, then runs calls. 2. A later call with BEHAVIOR_REVERT_ON_ERROR reverts the entire transaction → nonce…

Sharwa Finance Exploit — Margin Position Closed Against an Attacker-Manipulated Spot Pool (No Slippage Bound)

Loss · ~$146,000 total (real attack, multiple position cycles). This PoC reproduces one cycle, n…

Sharwa Finance is a margin-trading protocol. To open a "long WBTC" position the protocol borrows USDC from its LiquidityPool and swaps it for WBTC on Uniswap V3, sizing…

Sorella L2 Angstrom — All rewards can be stolen via incorrect active liquidity at boundary ticks

1. When the current tick is an exact multiple of tick spacing at an upper liquidity bound t1, zero-for-one iteration should apply liquidityNet[t1] first. 2. _advanceToNe…

Strata Tranches — donation-prevention gamed → withdrawals stuck

Donate to Strategy before first deposit → first mint is 1 wei of shares. Later large deposits still leave totalSupply < MIN_SHARES. Every withdraw reverts; capital stuck.

Strata Tranches — sUSDe withdrawers always incur a loss (inverted CDO params)

1. Withdraw of 100 sUSDe (worth 150 USDe at 1.5 rate) burns 150 JRT shares. 2. Tranche passes (baseAssets, tokenAssets) but CDO expects (tokenAmount, baseAssets). 3. Str…

Strata Tranches — withdrawal active requests DoS'd by malicious users

Anyone can call transfer(..., victim, 1 wei) and inflate the victim's request array. finalize iterates all entries → OOG after ~35k spam (shown via sample×extrapolate).

TokenHolder / BorrowerOperationsV6 Exploit — Privileged-Role Confused-Deputy Drain via `sell()`'s Arbitrary Call

Loss · 20 WBNB drained from the protocol's TokenHolder vault per sell() call (attacker netted 19…

TokenHolder is a small lending vault that holds WBNB and lends it out via privilegedLoan() — a function correctly guarded by onlyBorrowerRouter, so only an address holdi…

Ammplify — H-10: `subtreeBorrowedX/Y` is node-only (makers underpaid)

1. Child holds large subtreeBorrowed; parent holds small own borrow. 2. Fee charge on parent adds only parent.subtreeBorrowedX (node-only). 3. Child mass ignored → fees…

Ammplify — H-11: Segment-split geometric-mean borrow overstates taker fees

1. Full-range borrow at one GM tick is the economically intended base. 2. Segment tree stores liq in multiple nodes; each uses its own GM. 3. Sum of segment borrows ≫ fu…

Ammplify — H-3: Pool liquidity vs node liquidity mismatch from wrong `PoolWalker.settle` route

1. WalkerLib.modify marks nodes using high index treeTick(highTick) - 1. 2. PoolWalker.settle walks high index treeTick(highTick) (one higher). 3. Settlement skips the c…

Ammplify — H-5: Borrow fee uses APY as per-second rate (extreme overcharge)

1. Smooth rate curve returns an annual rate (APY) in Q64.64. 2. chargeTrueFeeRate does takerRateX64 = timeDiff * calculateRateX64(util) with no / 365 days. 3. Even 1 sec…

Ammplify — H-6: First-deposit share inflation steals compounded maker deposits

1. Each compounded segment acts as a vault with shares = liq * totalShares / totalLiq (floor). 2. Attacker seeds min liquidity, donates, shrinks to 1 share, donates agai…

Ammplify — H-7: `collectFees` re-targets original `asset.liq` after `adjustMaker`

1. newMaker stores asset.liq = 300e18. 2. adjustMaker sets live liq to 100e18 but leaves asset.liq unchanged. 3. collectFees re-targets to asset.liq → position snaps bac…

Ammplify — H-8: Uninitialized Uniswap ticks inflate `getInsideFees` (funds stuck)

1. Open maker while ticks uninitialized and price inside range. 2. Snapshot stores feeGrowthInside = feeGrowthGlobal (inflated). 3. Settle initializes ticks; later getIn…

Ammplify — H-9: Parent borrow marks sibling but settle skips sibling mint

1. Taker demand on a child forces borrow from parent. 2. Sibling also receives preBorrow (parent liq = both children). 3. Settle walks only the op route (child+parent),…

Ammplify maker spot-price manipulation — AuditVault 63167

Maker deposits value liquidity using a manipulable Uniswap spot price.

Ammplify malicious pool address — AuditVault 63179

newMaker accepts an attacker-controlled pool and transfers protocol token accounting to it.

H-1: notifyUnsubscribe gas underestimation leaves phantom gauge liquidity

Uniswap unsubscribes while Deli gauge keeps full position liquidity (phantom dilution)

H-4: Finalize-window auto-vote change manipulates past epoch

Post-epoch auto-vote + live balance counted at finalize; WETH allocation manipulated

Kame Aggregator Exploit — Unvalidated `executor.call()` in `swap()` Drains User Approvals

Loss · 18,167.88 USD (USDC, 6 decimals — pulled from one approving user)

AggregationRouter is a DEX-aggregator router on Sei. To execute a swap it forwards the user's tokens to "an executor" and then performs a single, fully attacker-supplied…

Licredity — decreaseDebtShare bypasses interest accrual

1. Interest accrues only in unlock / swap / LP add-remove paths. 2. decreaseDebtShare is allowed outside unlock because it only reduces debt. 3. It burns fullMulDivUp(de…

Licredity — proxy-based self-liquidation creates bad debt for lenders

1. Licredity.seize tries to stop an owner from profitably self-liquidating with if (position.owner == msg.sender) revert CannotSeizeOwnPosition(). 2. This checks only th…

Licredity — self-triggered afterSwap back-run enables LP fee farming

1. When price hits/goes below 1, _afterSwap auto back-runs a reverse swap to restore parity. 2. That back-run pays swap fees to LPs. 3. A dominant LP around 1 captures n…

Licredity — swap-and-pop without index fix-up corrupts Position fungibles

1. Position tracks fungibles in an array and a fungibleStates mapping (1-based index + balance). 2. On full remove, the code swap-and-pops the array but never updates th…

MetaMask — TotalBalanceEnforcer validation bypass with state-modifying enforcers

afterAllHook early-returns when shared BalanceTracker was cleaned by a prior TotalBalance enforcer; later enforcers skip validation after mid-chain state changes

NGP Token Exploit — Sell-Fee Burns NGP *Out of the Pair* and `sync()`s, Collapsing the AMM Reserve

Loss · ~493,467 USDT in this single simulated transaction (the campaign drained ~2M USDT total a…

NGP is a fee-on-transfer token. On every sell (any transfer where to == mainPair), its _update hook does something a token must never do: it moves the treasury fee + rew…

Super DCA — H-4: Bucket rewards wiped by stake/unstake before accrue

After rewards accrue on a bucket, any stake/unstake resets lastRewardIndex to current rewardIndex. Subsequent accrueReward sees delta 0 → paid = 0.

0x8d2e Exploit — Permissionless `uniswapV3SwapCallback` Drains the Contract's USDC

Loss · 40,000 USDC (≈ $40k) — the entire USDC balance of the victim contract

0x8d2e is some kind of trading/router contract that exposes a Uniswap-V3-style uniswapV3SwapCallback(int256 amount0Delta, int256 amount1Delta, bytes data). In a real Uni…

0xf340 VRF-Wrapper Exploit — Permissionless `initVRF()` Hijacks the LINK Payment Recipient

Loss · ~$4,000 — 160 LINK drained, swapped to 0.837736523415338256 ETH

0xf340 is a thin Chainlink VRF wrapper (a TransparentUpgradeableProxy delegating to implementation 0xd92A9110…). It holds a balance of LINK and, when randomness is reque…

ABCCApp Exploit — Permissionless `addFixedDay()` Vesting Time-Warp Drains the DDDD Reward Reserve

Loss · ~10,062 BUSD profit per cycle (≈ the protocol's DDDD reserve, sourced from prior deposito…

ABCCApp is a "deposit-and-earn" / referral scheme. A user deposits BUSD; the contract:

AutoPooledTradingBot double-withdrawal — withdrawInvestment pays out from deposits without burning shares, so emergencyWithdrawAll pays the same position twice

Loss · 0.15198 ETH on-chain (PoC reproduces 0.152158266800401203 ETH net profit after flash-swap…

AutoPooledTradingBot is an ETH "auto-trading pool" that issues share tokens on deposit() and lets users exit through one of two paths: withdrawInvestment() (an "earnings…

BaseCallback `0x8d2e…` Exploit — Unauthenticated `uniswapV3SwapCallback` Self-Transfer

Loss · 40,000 USDC (~$40K) held by the vulnerable contract

Unlike Q12 (approval transferFrom drain), this victim held the USDC itself. Its uniswapV3SwapCallback accepts a call from any msg.sender and, for amount0Delta > 0, does:

BaseSwapperUniswapV3 public swap drains its own token balance — arbitrary public access + full-balance refund to caller-chosen recipient

Loss · ~1,847.33 USD (472,997,613,026,749,247,557,538 wei of a deflationary victim token, draine…

BaseSwapperUniswapV3 is an admin-owned wrapper around the Uniswap V3 ISwapRouter. Its admin registers token paths via setPath() and pre-approves the router for type(uint…

Bebop JAM Settlement Exploit — Signature-Bypass + Unconstrained Interactions Drain Stale Approvals

Loss · 20,069.560783 USDC (~$20.1K) drained from two pre-approving users; campaign total ≈ $21K

JamSettlement is the on-chain settlement engine for Bebop's "JAM" RFQ trading. A solver calls settle(order, signature, interactions, hooksData, balanceRecipient); the co…

Bebop JamSettlement self-taker arbitrary-interaction drain — caller-supplied `transferFrom` calldata executed by the settlement contract against accounts that approved it

Loss · 3,875.46 USD (1,000 USDC + 901.467 uXRP)

Bebop's JamSettlement.settle(...) is meant to atomically execute a signed swap: a taker's signed JamOrder authorizes pulling the taker's sell tokens, then the solver pas…

Beefy ZapRouter arbitrary route execution — arbitrary `call()` spent victim allowances via `transferFrom`

Loss · ~6,584.95 USD (2,782.482 vault-A mooTokens + 2,779.111 vault-B mooTokens stolen from two…

Beefy's BeefyZapRouter is a generic "zap" router: a user deposits input tokens, the router runs an arbitrary caller-supplied list of Steps (each a low-level target.call(…

BSC "DD" initcode-token drain — unverified victim exposes arbitrary token-path swap using its own WBNB

Loss · ~0.913 WBNB in the PoC (victim drained from 912.716e15 WBNB to 2,486,728 wei WBNB). On-ch…

The victim contract 0x0B0d…c4Da exposes a public function (selector 0xdc0b3665) that takes a token pair and an amountIn and performs two PancakeSwap swapExactTokensForTo…

Caller-supplied ControlTower grants migrator power — AuditVault synthetic reduction

This bug report is about a vulnerability found in a contract called the "2025-08-usg-tangent-judging" contract. The vulnerability was discovered by multiple individuals…

Coinbase Fee-Account Drain — Confused-Deputy via 0x Settler `BASIC` Arbitrary Call

Loss · ~$300,000 total across multiple tokens. This PoC reproduces one leg: 105,493.58 ANDY drai…

The 0x Settler is a swap router that, by design, can be told to perform a raw external call to any address through its BASIC action (selector 0x38c9c147). The Settler is…

D3X AI Exploit — Proxy `exchange()` Prices D3XAT From A Manipulable PancakeSwap Spot Reserve

Loss · 190 BNB (≈ 135,919 USDT net intra-transaction profit, per the balance log)

D3X runs a small in-house "swap desk": a TransparentUpgradeableProxy exposing exchange(fromToken, toToken, amount) (first call: output.txt:1739). When you sell D3XAT int…

Equilibria (VaultEPendle) — reward debt not updated on ERC20 share transfer, draining native-ETH rewards via fresh receivers

Loss · ~62,661.57 USD (≈ 13.29 ETH drained in this reproduction; on-chain incident per @KeyInfo)

Equilibria's VaultEPendle ("stk-ePendle") is a single-asset auto-compounding vault that wraps ePendle (Equilibria's 1:1 escrowed Pendle) and distributes extra EQB / xEQB…

EverValueCoin (EVA) Exploit — Stale-Price Orderbook Settlement Arbitraged Against a Live AMM

Loss · 1.19331 WBTC drained from the order book (DeFiHackLabs header: ~$100k; ≈ $130k at the ~$1…

OrderBookFactory is a custom on-chain limit order book. When a new order matches a resting order, it settles instantly and atomically at the resting order's stored price…

Fake staking pool is accepted by stakeNxm — AuditVault synthetic reduction

This bug report discusses a vulnerability found in the stNXM contract, which allows the contract owner to steal funds from the contract. The bug was found by multiple in…

Grizzifi Exploit — Sybil Milestone-Reward Farming via Self-Referral Chain

Loss · ~$61,000 USD on-chain (BSC-USD). The minimal PoC here nets +1,000 BSC-USD per round (600…

Grizzifi is a USDT (BSC-USD) staking / MLM-style protocol. Besides daily staking yield, it pays "team milestone" bonuses: when the count of people in your downline ("tea…

GTE — burn over-estimates LP distribution when launchpad fees accrued

1. Accrued launchpad fees sit in pair balances but are excluded from reserves. 2. mint prices LP against reserves; burn pays out against full balances. 3. Mint + burn ca…

GTE — Distributor addRewards with fake quoteToken drains real rewards

1. addRewards(launch, fake, 0, amount) accepts any token1. 2. Fake transferFrom succeeds; pendingQuoteRewards inflates. 3. Claims pay the registered real quote token. 4.…

GTE — DOS graduation via 1-wei donation + sync

1. Donate 1 wei quote to empty pair and sync(). 2. Reserves become one-sided (0, >0). 3. UniswapV2Library.quote requires both reserves &gt; 0 → reverts. 4. HARM: graduat…

GTE — free LP mint when accrued launchpad fees are non-zero

1. Reserves = balances − fees. 2. mint without transfer sees amount = fees → free LP. 3. Burn cashes out the free share of pool assets. 4. HARM: both tokens stolen with…

GTE — Launchpad pairFor CREATE2 salt mismatches factory

1. Factory salt = keccak(token0, token1, launchpadLp, feeDistributor). 2. pairFor salt = keccak(token0, token1) only. 3. If createPair already exists, try/catch leaves t…

GTE — swap drains pair via phantom amountIn from launchpad fees

1. Reserves exclude accrued launchpad fees; balances include them. 2. amountIn is inferred as balance - (reserve - amountOut). 3. Taking amountOut ≈ fee with no transfer…

Hexotic (HEX-OTC) Exploit — Mispriced OTC Orders Arbitraged Against Uniswap-V3 Spot

Loss · ~$500 (the over-paid ETH escrowed in two mispriced orders). In this fork run the attacker…

HEXOTC is a tiny peer-to-peer OTC escrow for swapping ETH ⇄ HEX. A maker can lock ETH in the contract (an "ETH-escrowed" offer, escrowType == 1) declaring how much HEX t…

Hiding a staked NFT inflates share ownership — AuditVault synthetic reduction

Summary: The bug report describes a vulnerability in the stNXM smart contract that allows the owner to manipulate the value of the staked Nexus NFT without withdrawing i…

LUXERA (XERA) Exploit — Dangling Infinite Approval to Multicall3 Drained via `aggregate3`

Loss · ~$17K — 41.0347 WBNB drained from the XERA/WBNB PancakeSwap pair

The XERA token contract itself is a textbook OpenZeppelin-v5 ERC20 with fee/dividend extensions; its transferFrom/_spendAllowance are standard (ERC20.sol:154, ERC20.sol:…

MyCoinMaster missing-access-control on `buyBYAdmin` lets anyone mint MYC for free and drain the pool via `swap` — public function lacked an `onlyAdmin` guard present on every other privileged path

Loss · ~653.49 USD (653.63 USDT) — [output.txt:1594,1663,1672]

MyCoinMaster is a BNB-Chain token-sale / staking protocol where users normally buy the MYC token by paying either BNB or USDT. The "buy" path locks the purchased tokens…

Owner burns liquidity from an arbitrary NFT position — AuditVault synthetic reduction

This bug report discusses an issue found in the stNXM contract, where the owner is able to steal funds from the vault and the protocol is unable to recover them. The bug…

PDZ / "TB Build" Exploit — Spot-Price `getAmountsOut` Reward Inflation

Loss · 3.3 BNB (per PoC @KeyInfo)

The PDZ ecosystem has a "burn-to-earn" mechanic. A user calls TOKENbnb.burnToHolder(amount, _invitation): they give up amount PDZ tokens (which get sent to the dead addr…

Pendle Reflector — reflect() operated on Reflector-held balances using caller-supplied, unvalidated market and limit-router addresses

Loss · ~2,304.18 USD (Reflector's full balances of PT-mPendle-27MAR2025 and PT-stk-EPendle-27MAR…

Pendle's Reflector is a thin fronting contract whose only job is to take a blob of calldata, re-scale the input amount to whatever balance Reflector itself happens to ho…

PresaleV5 oracle manipulation — flash-loan spot-price (`slot0`) read by the presale pricing function let an attacker buy tokens cheap and sell them at fair price

Loss · 2.3157 ETH (attacker net profit)

PresaleV5 is an ETH/USDT-based token presale ("dynamic sale") whose token price is not a fixed schedule but is derived on-chain from a Uniswap V3 pool. The price functio…

RWf(x) undercollateralized underflow — AuditVault 63647

loadSwapState subtracts debt from collateral without handling an undercollateralized system.

Size Credit `LeverageUp` Exploit — Arbitrary External Call via `GenericRoute` Swap Drains User Approvals

Loss · ~$19.7k — 20,000 PT-wstUSR-25SEP2025 drained from one approving user

LeverageUp is a "one-click leverage" helper on top of the Size Credit lending market. To build a leveraged position it has to swap tokens, and it supports several swap b…

Size Credit FlashLoanLoopingV1_7 Generic-Route Arbitrary Call — third-party token allowance theft via caller-controlled `router.call(data)`

Loss · ~533 USD (540.576557 PT-wstUSR-25SEP2025 tokens stolen from one victim) [output.txt:1564-…

Size Credit's FlashLoanLoopingV1_7 is an Ownable zap contract that lets a user flash-loan from Aave, swap the borrowed token into collateral, deposit, and borrow in one…

Unverified Polygon swap router drained via fake Uniswap V3 pool — attacker-supplied pair/callback trusted without authentication

Loss · 3,131.106630910288079590 DAI (entire victim DAI balance)

0xd132…3B0bafF is an unverified Polygon contract exposing a swapSingleToken(address pair, address from, address token, bool zeroForOne, uint256 amount) selector that mim…

Unverified proxy `0x6f7a` drained via permissionless `rebalanceAndAddLiquidity` selector — anyone could push a victim's live token balance through its liquidity path

Loss · 7,630.46 USD reported (~0.25 WETH realized by the attacker on this fork) [output.txt:1539…

The victim contract 0x6f7a is a proxy that holds a treasury of DAI, WETH and FEI and, through its implementation, can "rebalance" its holdings into liquidity positions b…

WXC Token Exploit — Burn-From-Pool + `sync()` "Phantom Reserve" Drain

Loss · 37.55 WBNB net profit to the attacker (≈ the pool's honest WBNB liquidity, drained from t…

WXC is a sell-taxed, "deflationary" BEP-20. Its transfer logic treats a transfer to the LP pair as a sell, and as part of that path it burns the seller's net (post-tax)…

YuliAI Exploit — Buyback Priced off a Flash-Manipulated V3 Spot Price

Loss · ~$78,800 — 78,799.93 USDT drained from the YULIAI buyback contract

The contract at 0x8262…6282 is a YULIAI buyback desk: anyone can call sellToken(amount) to sell YULIAI to it, and it pays out USDT computed from the live YULIAI/USDT Pan…

Yuzu non-atomic updatePool sandwich — AuditVault 62757

A donation can be inserted before updatePool, changing the spot-derived pool value in the same transaction sequence.

AnyswapV4Router permit-fallback drain — trusting a non-reverting `permit()` on a token that does not enforce it

Loss · 200 WETH (amount modelled in the PoC; the on-chain attack tx drained a victim who had a s…

AnyswapV4Router is a cross-chain bridge router. Its anySwapOutUnderlyingWithPermit entry point is meant to take an EIP-2612 permit signature from a user, apply it on the…

Aragon — EarlyExecution proposals vulnerable to flashloan vote attacks

1. EarlyExecution mode executes a proposal as soon as a YES vote pushes it over the support threshold. 2. If the lock token is flashloanable/flashmintable, an attacker c…

Arcadia RebalancerSpot — Unvalidated `swapData` → Arbitrary `router.call`

Loss · ~$2.5–3.6M total (multi-tx; ~1203 ETH bridged). This PoC primary victim ≈ 197.72 WETH

Arcadia’s RebalancerSpot is an Asset Manager for user Accounts. Initiators call rebalance(account, …, swapData). When swapData is non-empty, SwapLogic._swapViaRouter dec…

BIFKN314 (ERC-314) flash-swap LP inflation — reserve snapshot taken after swap-out, before repayment, lets a dust `addLiquidity` mint pool-dominating LP shares

Loss · ~2,422.73 USD (91.15 AVAX profit, on-chain trace output.txt:1565)

BIFKN314Mintable is an ERC-314-style native/token pair that bundles a Uniswap-V2-like constant-product pool with a built-in flash swap: flashSwap() sends AVAX and the pa…

BoJ Leverage Market cbBTC reserve index inflation — flash-loan fee compounding against a near-empty aToken supply inflates the liquidity index to steal every listed asset

Loss · ~7,227.59 USD (mixed: WETH, USDC, AERO, MORPHO, DEGEN, VIRTUAL)

The BoJ Pool is an Aave-v3-derived lending market on Base branded around "Bank of Japan" leverage. Like upstream Aave v3, when a flash loan is repaid the LP portion of t…

Consensus accepts duplicated signers — AuditVault synthetic reduction

This bug report discusses a vulnerability found in the Mellow Flexible Vaults protocol, which was discovered by multiple individuals. The issue lies in the SignatureQueu…

Empty Set Reserve stale fixed-order drain — buying COMP below market from a hard-coded maker/taker price

Loss · ~$1,509.78 (≈ 0.4157 ETH extracted)

Empty Set Reserve (ESR) is a legacy Empty Set Dollar derivative contract that, among other things, runs a small on-chain OTC "order book." Each order is just a (price, a…

FeeManager miscalculates performance fees — AuditVault synthetic reduction

This bug report discusses an issue found in the performance fee calculation of the Mellow Flexible Vaults protocol. The current formula used in the FeeManager.calculateF…

FPC Token Exploit — Sell-Side `burnLpToken()` Drains the Pool's Own FPC Reserve

Loss · ~4.67M USDT (attacker net profit 4,671,608.07 USDT; reported headline ≈ $4.7M)

FPC is a "tax/deflation" token whose ERC-20 _update hook adds custom buy/sell logic. On a sell (any transfer into the FPC/USDT pair that the token classifies as a sell),…

GMX v1 Exploit — GLP Share-Price Manipulation via `globalShortAveragePrice`

Loss · ~$41M — GLP-pool reserves drained across 9 tokens (WETH, BTC/WBTC, USDC, USDe, LINK, UNI,…

GMX v1 prices its liquidity-provider token, GLP, off the Vault's Assets Under Management (AUM). For each non-stable token, AUM includes the aggregate unrealised PnL of a…

GTE CLOB — amend bypasses maxLimitsPerTx

1. postLimitOrder enforces maxLimitsPerTx via incrementLimitsPlaced. 2. amend to a new price creates a new book position without incrementing. 3. Attacker posts up to th…

Liquity V2 ActivePool `urgentRedemption` — permissionless extraction of collateral from shut-down undercollateralized troves at a +2% bonus

Loss · ~2,696.49 USD (1.0385 ETH per on-chain transaction) output.txt:1562

Liquity V2 lets each collateral branch (e.g. the sUSDe branch) be shut down in an emergency. When a branch is shut down the TroveManager opens a public urgentRedemption(…

Liquity V2 scrvUSD branch urgent-redemption arbitrage — permissionless cherry-picking of undercollateralized troves with a 2% bonus

Loss · ~$4,204.55 USD (net ETH profit 1.669775970301739864 ETH)

Liquity V2 lets a collateral branch be shut down when its total collateral ratio falls below the shutdown collateral ratio (SCR). Once shut down, normal borrowing and re…

Mellow Flexible Vaults — native token withdrawals permanently bricked

1. Protocol lists native token (0xEeee…eEEeE) as a supported asset. 2. Liquid-asset queries always call ERC20 balanceOf on the asset address. 3. Native sentinel has no c…

Mellow Flexible Vaults — protocol fee multi-accrual in submitReports

1. Each handleReport accrues protocol fees from last timestamp → now. 2. updateState only writes the timestamp when the asset is the base asset. 3. Non-base-first batch…

Mellow Flexible Vaults — RedeemQueue batch vs claim timestamp mismatch

1. Batch creation excludes the last request at/before the report timestamp (index--). 2. Claim eligibility still allows any request with ts ≤ priceTimestamp. 3. User2 cl…

MulticallWithETH Exploit — Arbitrary-Call `aggregate()` Drains an Unlimited USDC Approval

Loss · ~10,536.89 USDC (10,536,885,633,853,077,370,507 wei, 18-dec USDC on BSC)

MulticallWithETH is a generic, Multicall3-style batch executor. Its core function aggregate() loops over a caller-supplied list of (target, callData, value, allowFailure…

RANT Token Exploit — Self-Transfer Triggers Un-compensated LP Reserve Burn

Loss · ~311.48 BNB (~$190K at the time) drained from the RANT/WBNB PancakeSwap pair

RANTToken is a "deflationary + auto-burn" meme token. Its _transfer override has a special branch: when a non-pair, non-whitelisted address sends RANT to the token contr…

Redeem queue burns shares before charging fees — AuditVault synthetic reduction

This bug report discusses an issue found by a group of users regarding the redeem function in the RedeemQueue contract. When a user redeems their shares, the shares are…

Remora Pledge: `changeStablecoin` swaps the payment token's decimals without rescaling raw-unit accounting

Remora Pledge: `pledge` spends a victim's stablecoin because it never checks `msg.sender == data.signer`

Remora Pledge: `pricePerToken * numTokens` multiplies two `uint32`, so every pledge above ~$4,294 permanently reverts

Remora Pledge: PaymentSettler can change its stablecoin but RemoraToken can't, permanently DoSing fee-bearing transfers

Remora Pledge: removing a shared forwarder calls `deleteUser`, wiping `calculatedPayout` still owed to every other forwarding holder

Remora Pledge: uint64 `calculatedPayout` overflows on high-decimal stablecoin payouts, permanently bricking claims

Resolv self-transfer reward theft — AuditVault 61872

Self-transfers credit both sender and recipient reward paths, doubling the reward.

Securitize OnRamp replay — signed transactions remain valid after use

executePreApprovedTransaction includes a nonce in the signed payload, but only increments the stored nonce. It never requires the supplied nonce to equal the current exp…

StakeDAO — [C-01] Missing extra reward per token update on deposit

First user deposits and extra rewards are funded. Second user deposits a huge amount without the index updating first, then withdraws/claims — receives ~100k/100001 of r…

Stepp2p Exploit — Double-Refund via `modifySaleOrder` on an Already-Cancelled Order

Loss · ~$43.8K — 43,782.41 USDT (BSC-USD) drained from the Stepp2p escrow contract

Stepp2p is a simple P2P USDT escrow: a seller deposits USDT into a sale order and the contract holds it until a buyer purchases or the seller cancels. The accounting rec…

StrategyLlamaLendConvex share-accounting drain — a dust deposit minted strategy shares that redeemed for the strategy's entire Curve Lend position

Loss · 563.12 USDC (crvUSD-denominated drain of ~563 crvUSD from the strategy's Curve Lend / Con…

StrategyLlamaLendConvex is a Yearn V3 "tokenized strategy" that takes crvUSD as its asset and routes it into a Curve Lend vault (an ERC-4626), then stakes the resulting…

SuperRare Staking Exploit — Permissionless `updateMerkleRoot()` + Single-Leaf Merkle Forgery

Loss · ~$730K — 11,907,874.713 RARE drained from the staking contract (its entire RARE balance)

RareStakingV1.updateMerkleRoot() is meant to be callable only by the owner or one whitelisted address. Its guard is written with the comparison inverted:

SWAPP Staking Exploit — Unchecked `transferFrom` Return Value Lets a Free `deposit` Mint Staking Balance, Then `emergencyWithdraw` Drains the Vault

Loss · ~$32,196.28 — 1,286,577.59 cUSDC (raw 128,657,759,164,064, 8 decimals) drained from the S…

Staking.deposit() accepts an arbitrary tokenAddress. For any token that is not one of the three hard-coded stablecoins (USDC/USDT/DAI), it takes the "else" branch and ca…

Unverified-proxy USDT drain via recipient-only signature — signed 5-min/recipient message did not bind victim, token, amount, or nonce

Loss · 502.42 USDT (502.420508729654666584, trace balance) — the on-chain attack tx drained the…

A BNB-chain protocol exposed a delegatecall-based proxy (0xE641…106c) backed by an unverified implementation (0x8Fd3…7f0A). One of its functions (selector 0x97e76253) ta…

Unverified670471 — Balancer flash-loan callback forwarded to a victim that repays the loan with its own funds

Loss · ~$1,818.33 (484.9 mETH net profit ≈ 0.4849 ETH at fork-block prices)

The victim contract 0x6704713B... is configured to act as a Balancer IBalancerFlashLoanRecipient. Balancer's flash-loan primitive works by sending the borrowed tokens to…

Unverified6883 Fake-Pair Callback Hijack — UniswapV2 flash-swap callback trusts a freshly-created attacker pair and pays WETH into it

Loss · ~$1,006.89 (0.267592 WETH)

The victim (0x6883…) is an unverified swap helper/router that implements the UniswapV2 flash-swap callback uniswapV2Call. When invoked, it decodes an attacker-supplied p…

UPENG burn+sync drain — permissionless `burn(address,uint256)` lets anyone torch a Uniswap-V2 pair's token side, then `sync()` commits the manipulated balance as reserves

Loss · ~1.5 WBNB (1,500,999,999,999,999,999 wei) — the pair's near-total WBNB reserve [output.tx…

UPENG is a low-liquidity BEP-20 token paired against WBNB on PancakeSwap. Its UPENG/WBNB pair held roughly 21,000,000 UPENG against 1.5 WBNB at the time of the attack [o…

VDS Exploit — `deposit()` Mints 5× VDS for AVD, Redemption Refunds AVD 1:1

Loss · ~$11,136 (≈ 11,136.14 BSC-USD) profit to the attacker, drained from the AVD/BSC-USD Panca…

VDS is a token whose deposit(token, amount) lets a user deposit AVD and receive freshly-minted VDS. From the live trace, the mint rate is 5 VDS per 1 AVD (depositing 69,…

VII Finance — fees stolen from partially unwrapped `UniswapV4Wrapper` positions

1. Partial unwrap of a V4-wrapped position accumulates fees into tokensOwed and pays a proportional share to the unwrapper. 2. tokensOwed is never decremented, so the sa…

VII Finance — liquidations can be made to revert by an attacker

1. A borrower can enableTokenIdAsCollateral for a tokenId they do not hold. 2. Liquidation seizes value via transfer, which walks all enabled tokenIds. 3. normalizedToFu…

VII Finance — more value extracted by liquidations than expected (`normalizedToFull`)

1. Liquidation / value transfer walks every enabled tokenId and converts a unit-of-account amount into an ERC-6909 amount via normalizedToFull. 2. normalizedToFull multi…

weETH LRT Minter Exploit — Unprotected `0x03b79c24(address)` Token Sweep

Loss · ~$285.7K — 106.93 weETH swept, sold for 114.53 WETH (≈ $285.6K @ ~$2,494/ETH)

The vulnerable contract is a liquid-restaking-token (LRT) minter for weETH (its dispatch table exposes depositWeEth(uint256,address,address,bool), mintNrETH(), userLstBa…

WETC Token Exploit — Fee-on-Transfer + `skim`/`sync` Reserve Drain

Loss · ~$101k — attacker walked off with 101,421.95 USDT (net +101,395.4 USDT) drained from the…

WETC is a tax token. Its _transfer override taxes any transfer out of the pair as a "buy" (transferBuy, contracts_WETC.sol:104-117) and any transfer into the pair as a "…

WhereIsMyDragonTreasure — fixed redemption reward larger than the recipe cost to mint a legendary card

Loss · $47,461.35 (≈ 12.776 ETH, the full singleReward)

WhereIsMyDragonTreasure is a "treasure chest" side contract of the WhereIsMyDragon NFT-card game. Players who manage to obtain the game's legendary card can send it to t…

"b5cb0555" Exploit — Permissionless `printMoney()` Forwarder Drains a Trusted Treasury (Confused Deputy)

Loss · ~$35.3K drained from the treasury (22.49 WBNB + 1.51 ETH + 5,713.6 USDT + 4,253.6 TUSD +…

The protocol is split into two contracts that share the b5cb0555 vanity-address family:

AaveBoost Exploit — Permissionless `proxyDeposit()` Subsidy Drain

Loss · ~$14.8K — ≈48.6 AAVE drained from the AaveBoost subsidy reserve

AaveBoost.proxyDeposit(asset, recipient, amount) is meant to be a "deposit booster": when a user deposits into the AavePool through it, the booster contract adds a fixed…

Bankroll Network Stack Plus — public `buyFor(address,...)` spends any victim's LINK allowance and lets the caller skim the dividend pool it just inflated

Loss · ~12,234.48 USD (933.93 LINK net to the attacker) [output.txt:1565,1977]

BankrollNetworkStackPlus is an old-school "dividend drip" farming contract (a POWH/Bankroll-network descendant) priced 1:1 in LINK. Every buy pays a 10% entry fee, a 10%…

BankrollNetwork Stack Exploit — Stale `lastPayout` Instant-Drip Dividend Inflation

Loss · 24.586 WBNB net attacker profit (≈ 29.786 WBNB of honest user deposits drained from the c…

BankrollNetworkStack is a "drip pool" rewards contract (a fork of the well-known X-Perpetual / Bankroll family). Donations go into dividendBalance_, and a time-based dri…

BankrollStack (BankrollNetworkStack) Exploit — Flash-Loan Dividend-Drip Capture

Loss · 5,385.806 BUSD (~$5.4K) profit to the attacker, drained from the contract's dividend pool

BankrollNetworkStack is a "perpetual rewards" / POWH-style contract: users buy() shares with BUSD, pay an 8–10% fee that accumulates into a dividendBalance_ pool, and th…

BasePricePool `withdrawGOUT` price-decoupling — manipulable-balance oracle lets flash-bought QCD be redeemed for GOUT at an inflated internal rate

Loss · ~802.57 USD (≈800.97 USDT net profit in the reproduced trace)

BasePricePool is a simple "coin-to-GOUT" exchange: a user calls withdrawGOUT(amount) with a QCD (coin) allowance, the contract pulls the QCD, computes how many GOUT toke…

Batch nonce overflow freezes withdrawals — AuditVault synthetic reduction

This bug report discusses an issue that was found in the Notional Finance protocol by a group of individuals. The issue involves a function called DineroWithdrawRequestM…

BitCrown Distributor Drained via Unprotected batchTransfer — anyone could move the distributor's token balance to any recipient

Loss · ≈ 7,939.27 USDT (≈ $7,939) — 100,000 BITCROWN drained from the distributor and dumped

BitCrown is a BEP-20 token on BNB Chain that, like many low-cap launches, keeps a large portion of its supply inside a dedicated "distributor" contract (0x93b6…A2A7e) in…

BSC MEV Vault `0xb5cb…` — Authorized Helper Arbitrary Call Drains Venus vTokens

Loss · ~$1.1M first tx; campaign ~$2M across follow-ups (TenArmor)

A Venus-integrated MEV / strategy vault (0xb5cb…e1b0) gates sensitive operations (including vToken transfers via selector 0x0243f5a2) behind isAuthorized. Days before th…

FixedTokenBSwap RTV drain — attacker-supplied `path` + fake-token `transferFrom` bypass the on-chain price check, extracting a fixed 10 RTV per call

Loss · 500 RTV drained from the swap contract (~2,203.63 USD headline; ~1,617 USD in realized ET…

FixedTokenBSwap is a "swap X for a fixed 10 RTV" sale contract. The price of the input token is computed on-chain with router.getAmountsIn(tokenBOut, path), where the en…

Gangster Finance "OG Vault" Exploit — Stale `lastPayout` Drip-Pool Drain via Self-`donate()` + `harvest()`

Loss · ~0.1558 BTCB ≈ $16.5k drained from the vault's BTCB reserves

Gangster Finance's TokenVault is a yield "vault" where users stake a base token (here BTCB) and earn dividends from a drip pool (dripPoolBalance). The drip pool is paid…

Gradient Market Maker Pool Exploit — Mixed-Unit LP Share Accounting (ETH wei summed 1:1 with ERC-20 token units)

Loss · ~$5,000 — 3.0109 ETH of honest LP liquidity drained from the GRAY pool (PoC nets 2.346 WE…

GradientMarketMakerPool is a per-token "market maker" pool where users deposit ETH + a token and receive LP shares. The pool computes everything — LP shares, total liqui…

H-2: Attacker drains Morpho suppliers by inflating collateral price

500k USDC drained from Morpho suppliers via post-withdraw yield donation

H-4: Direct Morpho borrow misprices withdrawal-request collateral

Over-borrow vs request-backed LTV (bad debt) when Morpho price ignores withdraw request

H-7: claimAccountRewards pays MORPHO the users rewards

100 reward tokens stolen to MORPHO address via permissionless claimAccountRewards

HoldSafe price-manipulation referral drain — oracle pricing of stake value and rewards from a manipulable DEX spot route

Loss · ~4,824.96 USD (6.9668 WBNB net profit, output.txt:1565)

Hold_Safe is a BSC staking/"donation" contract: a user calls Stake(usdtAmount, referrer) to "donate" a USDT-denominated amount (capped at maximumDeposit = 2000 USDT). Th…

InitcodeFactory `collectFees` — caller-authorizes via fake token `creator()` and drains ETH on a non-WETH `token1`

Loss · ~2,383.25 USD (≈ 0.9793 ETH stolen)

Factory (0x930f9f…) is a launchpad that mints its own ERC-20 tokens and seeds a Uniswap V3 pool (token↔WETH, 1% tier). It retains the V3 liquidity NFT itself and exposes…

KittenSwap — `RebaseReward` fails because of incorrect token handling

1. notifyRewardAmount only accepts Kitten, but incentivize accepts any token. 2. On claim, every reward token's share is deposited as Kitten via deposit_for. 3. Equal-we…

KittenSwap — Lack of `lastMintedPeriod` update allows unlimited minting of Kitten

1. Minter.updatePeriod() is meant to mint weekly Kitten once per epoch period. 2. The guard is if (currentPeriod > lastMintedPeriod). 3. After minting, the code never wr…

Meta Pool (mpETH) Exploit — Free `mint()` on a Native-ETH ERC4626 Vault

Loss · PoC measured profit: 8.892 ETH in cash + 77.79 mpETH (≈ 85.8 ETH @ 1.1029 ETH/mpETH) ≈ ~9…

Staking is Meta Pool's liquid-staking vault. mpETH is its ERC4626 share token, but the asset is native ETH, not the ERC20 _asset (WETH) that OpenZeppelin's ERC4626Upgrad…

MOMO Buyback-Bot Exploit — Permissionless, Slippage-Free `5ff02eae()` Sandwiched on a Thin USD1/MOMO Pool

Loss · ~$48.3K — 48,264.80 USD1 extracted from the MOMO buyback bot

0x8490… is a buyback/treasury bot for the MOMO token. It holds a pile of USD1 (48,758.887 USD1 at the fork block) and exposes a public function — selector 5ff02eae() — t…

Notional Exponent H-10: caller-controlled TradeType (EXACT_IN → EXACT_OUT) drains the vault on redemption

Notional Exponent H-11: expired-PT redemption uses `sy.redeem(..., minTokenOut: 0)` → sandwich drains the user

Notional Exponent H-3: Dinero withdraw manager over-withdraws via batch-ID overlap

Notional Exponent H-6: `uint16 s_batchNonce` overflow permanently bricks Dinero withdrawals

Notional Exponent H-8: PendlePTOracle assumes 1 SY == 1 Yield Token → inflated PT price → bad debt

Notional Exponent H-9: hardcoded `use_eth = true` on Curve V2 exit locks WETH-vault funds

Panoptic Hypovault — poolExposure1 premium operands reversed

1. Short premium is an asset; long premium is a liability. 2. poolExposure0 correctly does short − long; poolExposure1 reverses operands. 3. NAV understated (1050 vs 125…

ParaSwap Augustus — arbitrary `exchangeData` lets an unprivileged caller drain any account that approved the router — $2,299 DAI

Loss · 2,298.68 USD (2,299.037 DAI) — full drain of the victim account's DAI balance [output.txt…

ParaSwap's AugustusSwapper is a DEX-aggregation router. Its simpleSwap(SimpleData) entry point is designed to take a fromToken/fromAmount from the caller and execute an…

PegaBall — `buyGamesFrom` self-funds ticket purchases from the contract balance instead of `msg.value` — free vendor/referrer cut drain

Loss · ~0.579 ETH (~1,512.85 USD) — 129 free ticket purchases draining vendor + referrer cuts [o…

PegaBall is an on-chain PowerBall-style lottery. Tickets are bought through buyGames / buyGamesFrom, both payable. The intended model is: a buyer sends amount * gamePric…

Resupply Finance Exploit — Empty-Vault Share-Price Inflation → `exchangeRate = 0` → Uncollateralized Borrow

Loss · ~$9.6M — attacker netted 9,806,396.36 USDC from a 4,000 USDC flash-loan, zero starting ca…

Resupply lets users borrow its reUSD stablecoin against ERC-4626 vault shares (here, a CurveLend crvUSD/wstUSR lending vault). The collateral is priced by a one-line ora…

Silo Finance Exploit — Untrusted Swap/Silo Targets in `openLeveragePosition` Let Attacker Re-route a "Swap" into `Silo.borrow`

1. Silo Finance ships a public openLeveragePosition helper (the "Silo leverage helper", 0xCbEe4617…829DF9) that takes three user-supplied argument blobs: a FlashArgs (fl…

SinstakeNetworkZombie dividend-donation flash-drain — flash-borrowed ZOMBIE donates dividends that the same-tx buyer/seller immediately withdraws, netting excess ZOMBIE convertible to WBNB

Loss · ~705.13 USD (~1.1016 WBNB realized as profit) [output.txt:1564,1565,1784]

SinstakeNetworkZombie is a "dividend yield" contract: users deposit ZOMBIE (the project ERC-20), receive internal dividend-bearing shares (tokenBalanceLedger_), and earn…

Stead Farm Exploit — Permissionless STEAD Drain via Un-Access-Controlled Function

Loss · ~$14.5k — 135,000 STEAD (6 decimals) drained from the Farm contract

The Stead protocol deployed a farming / staking contract (proxy 0xf9FF…, implementation 0xca9d57…) that was funded with STEAD tokens to pay out yield. Its decompiled dis…

Superfluid Locker — Pumponomics can be skipped via `provideLiquidity`

1. Owner pre-sends WETH into the locker (not via provideLiquidity). 2. Calls provideLiquidity{value: dust}(supAmount). 3. Only dust * 1% is pumped (buy SUP); the positio…

Superfluid Locker — Staked tokens inside FluidLocker can be withdrawn without Unstake

1. Owner stakes all FLUID in the locker (_stakedBalance = balance). 2. provideLiquidity(supAmount) does not check available balance — staked tokens leave to Uniswap. 3.…

TokenFactory fake-router LP drain — caller-supplied swap infrastructure is trusted without verifying the returned pair belongs to the new token

Loss · ~657.17 USD (~1.006 WBNB of pair reserves, plus the attacker also received ~9.94e26 HODOG…

TokenFactory is a BNB Chain "token-launchpad" contract: anyone pays a small fee, calls createTokenAndAddLiquidity, and the factory deploys a new ERC20, approves a Uniswa…

TokenVault (Gangster Finance) — same-tx donate+deposit inflates fresh shares against the drip pool

Loss · ~3,226.51 USD (4.9836 WBNB) — attacker before 1.4702 WBNB, after 6.4538 WBNB

TokenVault is a staking/"vault" contract from Gangster Finance (an early BSC dividend-yield project). Holders stake a BEP20 token and earn a share of a "drip pool" that…

TSAggregatorGeneric arbitrary swap-target calldata drains victim allowance — attacker-chosen `swapRouter`/`data` lets `swapIn()` call any function on any token the aggregator is allowed to spend

Loss · 1,300.00 USDT (BEP-20) — 1,300 10*18 [output.txt:1621]

TSAggregatorGeneric is the THORChain Saver-style EVM swap aggregator: a user deposits an input token, the aggregator swaps it through some DEX and forwards native BNB to…

WAL-E Coin proxy reinitialization → authorized buyback drain — public `initialize()` with no guard rewrites owner/router and unlocks `triggerZeusBuyback`

Loss · 1.415367204023272901 BNB (~$430 at the time)

WAL-E Coin ($WAL-E) is a BSC "dividend + buyback" token deployed behind an ERC-1967-style transparent upgradeable proxy. The implementation, RewardsChain, performs all o…

Aria — stRWIP is always minted for RWIP in a 1:1 ratio

1. burnTicket always mints stRWIP equal to the ticket's RWIP amount (1:1). 2. unstake redeems stRWIP at the live exchange rate balance / supply. 3. After rewards inflate…

Beta (BETA) Presale — public `set()` + per-sender-only deposit cap let a recycled flash loan drain the presale

Loss · 1.921686798824852706 WBNB + 46.474821659738262175 BUSD (≈ 1,700+ USD at the time)

The Beta token presale contract PresaleBEP20 has two compounding flaws in its deposit() flow. First, anyone can call the public, unguarded set() to overwrite withdrawAdd…

BitallxSC payout-array bypass drains victim USDT balance — public `BitallxPayOut` validates only `totalSendAmount`, never `sum(amount[])`

Loss · 2,029.47 USDT (2,029,473,999,999,999,986,000 wei) — full victim contract balance [output.…

BitallxSC is a small BSC rewards/payout contract holding ~2,029.47 USDT in treasury. It exposes a function BitallxPayOut(tokencontract, wallet[], amount[], totalSendAmou…

Blackhole — inverted `setRouter` zero-address check bricks pool launches

1. setRouter(address _router) is meant to let the owner update the DEX router used when a GenesisPool launches and adds liquidity. 2. The require is inverted: require(_r…

Blackhole — Reward token in `GaugeFactoryCL` can be drained by anyone

1. createGauge is external with no authorization. 2. Each call seeds Algebra eternal farming with a hardcoded 1e10 of _rewardToken pulled from the factory. 3. Anyone can…

Blueberry HyperliquidEscrow — tvl() omits in-flight USDC

1. Non-USDC assets add same-block in-flight bridge amounts into TVL. 2. The USDC branch only counts balanceOf and skips in-flight. 3. Deposit against understated TVL min…

C-02: Missing packet ID in finalizeOpen causes NFT loss

Packet NFT stuck in contract; INSTANT_OPEN reverts; user loses NFT with no cards

CAP Labs — decimal count creates an inaccurate staked price

The adapter multiplies by capTokenDecimals and divides by stakedTokenDecimals instead of applying 10decimals. Six- and eighteen-decimal assets therefore receive a nonsen…

CAP Labs — fee auction charges for zero assets

FeeAuction.buy does not bind a purchase to an auction or require a non-empty basket. A front-runner drains the basket, then the victim pays the doubled price for zero ou…

CAP Labs — health and slashable collateral disagree

coverage includes current collateral while slashTimestamp limits slashing to the previous epoch. A fresh rescue deposit improves health but cannot be slashed in liquidat…

CAP Labs — inconsistent vault balance tracking bricks borrowing

An untracked donation supplies physical tokens for burn, but the burn still decrements totalSupplies. The accounting invariant falls below totalBorrows and subsequent bo…

CAP Labs — unvalidated vault address inflates interest rates

VaultAdapter.rate accepts any vault address and trusts its currentUtilizationIndex/utilization responses. A malicious implementation returns extreme values and permanent…

CAP Labs PriceOracle — global staleness period rejects valid feeds

CAP's oracle stores one staleness period for all assets. Configuring one hour for hourly ETH feeds makes a valid daily USDC-like report revert after five thousand second…

Chat points manipulation via custom Uniswap V4 pools

Full chat points for ~1% capital via unvalidated custom pool key

Cork Protocol Exploit — Permissionless Market Creation with Attacker-Controlled `exchangeRateProvider`

Loss · ~$12M — 3,760.88 wstETH drained from the live wstETH↔weETH PSM/Vault market

Cork Protocol lets a "Module" (a PSM + Liquidity-Vault pair) be created for a Redemption-Asset / Pegged-Asset (RA/PA) couple. Each module mints two receipt tokens per ep…

Crosswise MasterChef trusted-forwarder hijack — public setter with no access control enables arbitrary `_msgSender()` spoofing

Loss · ~4.16 WBNB (the public PoC drains this from the CRSS/WBNB pair; the on-chain attack drain…

Crosswise's MasterChef inherits OpenGSN's BaseRelayRecipient, which overrides _msgSender() so that when the caller is the trustedForwarder, the real sender is read from…

DODO Cross-Chain DEX — `withdrawToNativeChain` swaps arbitrary ZRC20 inventory

1. withdrawToNativeChain decodes DODO MixSwapParams from the user message. 2. _doMixSwap approves params.fromToken for the deposited amount — no check that fromToken ==…

DODO Cross-Chain DEX — empty `swapData` skips swap and pays high-value target 1:1

1. _doMixSwap short-circuits when swapData is empty: return amount. 2. No check that the deposit token equals decoded.targetZRC20. 3. Attacker deposits 100 AVAX.ZRC20, e…

DODO Cross-Chain DEX — missing `msg.value` check on ETH placeholder drains ZRC20

1. For non-ETH inputs, the gateway pulls tokens via transferFrom. 2. For zrc20 == _ETH_ADDRESS_, that pull is skipped — but msg.value is never checked. 3. Attacker claim…

DODO Cross-Chain DEX — swap output token ≠ withdrawal target drains gateway

1. onCall performs _doMixSwap(..., params.toToken) then withdraws decoded.targetZRC20. 2. Nothing requires toToken == targetZRC20. 3. Attacker crafts a message: swap BTC…

DODO Cross-Chain DEX — unauthorized claim of non-EVM chain refunds

1. Refunds store a walletAddress blob (20 bytes for EVM, longer for BTC/etc.). 2. claimRefund only decodes receiver when length is exactly 20; otherwise receiver stays m…

DogeAlliance sync() reserve manipulation — LP pairs with token balances desynced from reserves drained by permissionless sync + swap

Loss · ~990.33 USD (1.5044 WBNB at the time of the incident) — attacker net profit per [output.t…

DogeAlliance (DOGEALLY, BSC) is a meme token that listed across several PancakeSwap/ApeSwap-style DOGEALLY/WBNB, DOGEALLY/BUSD and DOGEALLY/CAKE LP pairs. The DOGEALLY t…

Dumbo DUM staking reward inflation — permissionless, repeatable `distribute()` lets an attacker mint compounding rewards inside one transaction

Loss · 628.447753459629926384 BUSD (≈ 628.45 BUSD) — reproduced locally [output.txt:1564-1565]

Dumbo ran an OlympusDAO-style "rebasing" staking system: users stake DUM, receive the receipt token sDUM, and a Distributor contract periodically calls distribute() to m…

IRYSAI Exploit — Backdoored `transferFrom` Lets the Tax Wallet Drain the LP Pool

Loss · ~$69.6K — 107.46 WBNB drained from the IRYSAI/WBNB PancakeSwap pair

IRYSAI's transferFrom contains a hidden privilege for the tax wallet: when msg.sender == _taxWallet, the function performs the balance move but skips the allowance deduc…

KRC Token Exploit — Fee-on-Transfer Token Burns From Its Own Pool, Desyncing Reserves

Loss · ~$7,155 — 7,154.81 USDT drained from the KRC/USDT PancakeSwap-V2 pair

KB (the KRC token) is a fee-on-transfer / reflection token. When tokens are transferred into the AMM pair, its _transfer override does something fatal: it burns a slice…

LayerEdge — Incorrect tier tracking when tier 3 staker exits

1. With 15 stakers, tiers are correctly (3, 4, 8). 2. A Tier-3 staker fully unstakes → expected (2, 4, 8). 3. Because new_t2 == old_t2, the removal path only rewrites ra…

LayerEdge — When stakerCountInTree increases, some users receive less interest

1. Staking grows from 14 → 15 users: tiers should go (2,4,8) → (3,4,8). 2. Rank 7 must promote T3 → T2. 3. Because new_t2 == old_t2, the add path only updates old_t1 + o…

LEND H-11: cross-chain borrow ignores per-chain token decimals (~1e12× overborrow)

LEND H-18: incorrect `srcEid` check in `borrowWithInterest` (cross-chain debt reads 0 → liquidation evasion)

LEND H-20: multiple cross-chain borrows reuse the same collateral (Nx overborrow)

LEND H-3: both cross-chain mappings populated bricks `borrowWithInterest` (liquidation evasion)

MBU Token Exploit — Decimal-Scaling Bug in `deposit()` Mints ~1e18× Too Many Tokens

Loss · ~2,157,126 BUSD (~$2.16M) drained from the MBU/USDT PancakeSwap pair

The deposit() entry point on 0x95e9… accepts a token (here WBNB), prices it in USDT via a spot AMM oracle, then mints MBU to the depositor based on that USD value divide…

Nalakuvara / LotteryTicketSwap50 Exploit — Fixed-Payout Redemption Drains the AMM Pool

Loss · 105,470 USDC (net profit to attacker, drained out of the NATA/USDC liquidity pool)

LotteryTicketSwap50 lets a user "buy lottery tickets" with USDC (transferToken) and later "destroy" those tickets to get a refund (DestructionOfLotteryTickets). The refu…

RICE / BentoBox-Clone Exploit — Signature-less `setMasterContractApproval` Lets Anyone Drain Any Depositor

Loss · ~34.52 WETH ($88.1K) — drained from a single depositor of a BentoBox/DegenBox-style vault

The vulnerable contract is a BentoBox/DegenBox clone (the function selectors, parameter layouts, and emitted events — LogRegisterProtocol, LogSetMasterContractApproval,…

Subsequent cross-chain borrow skips accrued interest — AuditVault synthetic reduction

This bug report discusses an issue that was found by a group of individuals on a platform called GitHub. The issue involves borrowing the same asset more than once on a…

Uniswap The Compact — incorrect emissary storage slot breaks authorization

1. Emissary config slots must be keyed by (scope, sponsor, lockTag). 2. Buggy packing writes lockTag over the memory region holding sponsor. 3. All sponsors share one co…

Unverified Base airdrop-claim contract drained via constructor-time claim spam — per-claimant eligibility keyed on `msg.sender` with no nonce/code/allow-list guard

Loss · 0.208333333333333384 ETH (≈ 551.22 USD at the time) — full victim balance drained

The victim at 0x91a1…193D is an unverified Base contract exposing a public claim() that sends the caller a fixed per-claim chunk of ETH and records that the caller has c…

Unverified BSC Victim Drain (mintTokens 0x88417d5c) — missing access control lets anyone sweep the contract's ERC20 balances

Loss · 5,658.46 USD (reported in @KeyInfo; reproduced drained balances below)

The victim contract at 0x000004…D0000 exposes a function with selector 0x88417d5c whose decoded signature is mintTokens(uint256,bool,bool,(address,uint256)[]) (the test'…

Unwarp Exploit — Permissionless `unwrapWETH(amount, recipient)` Self-Balance Drain

Loss · 3.9813269016365735 WETH (≈ $9K) — the vulnerable contract's own pre-existing WETH balance

The vulnerable contract exposes a permissionless function unwrapWETH(uint256 amount, address recipient). It unwraps the contract's own WETH (WETH.balanceOf(this)) into n…

Usual Money Exploit — `VaultRouter.deposit` Routes Through an Attacker-Controlled Swap Venue With No Real Slippage Floor

Loss · ~$43,000 — 15.925 WETH extracted out of Usual's VaultRouter / WrappedDollarVault deposit…

VaultRouter.deposit(augustus, USD0++, amountIn, minTokensToReceive, …, swapData) lets a depositor hand in USD0++, which the router unwraps 1:1 into USD0 and then swaps i…

YDT Token Exploit — Permissionless `proxyTransfer()` Drains the Liquidity Pool

Loss · ~41,337 USDT drained from the YDT/USDT PancakeSwap pair (PoC reports a final balance of 4…

YDTMainContract is a fee-on-transfer ("tax") token whose sub-modules (tax, referral, deflation, liquidity, LP-tracking) are allowed to move tokens around without re-trig…

Yearn yBOLD — Deposit after loss report free-rides collateral recovery

1. Victim deposits into the strategy. 2. Stability Pool liquidation burns BOLD; collateral gains are unrealized. 3. Keeper report() books a loss (PPS drops) because harv…

Yearn yBOLD — Steal 25% of first depositor funds via share inflation

1. Fresh strategy has totalSupply = 0 and no burned dead shares. 2. Attacker deposits 1 wei → 1 share, then donates until totalAssets = 1 + victimDeposit/2. 3. Victim de…

Aera Contracts v3 — incorrect received-swap-amount calculation lets guardians bypass the daily loss limit

1. Aera's slippage hook enforces a daily loss limit on guardian-directed swaps. To do so, its after-hook measures how much tokenOut the vault received as a balance delta…

AIRWA Exploit — Permissionless `setBurnRate()` + Zero-Value Transfer Pool-Reserve Annihilation

Loss · ~56.73 BNB (≈ $34,205 of BSC-USD liquidity drained from the AIRWA/BSC-USD PancakeSwap pai…

AIRWA is a fee/burn token whose burn rate is settable by anyone through a public, unauthenticated setBurnRate(uint256) function (selector 0x189d165e, no onlyOwner). When…

AmpKashi (Kashi AMP/USDC) flash-loan oracle manipulation — borrow against a stale spot price

Loss · 572.31 USDC (attacker net profit; the AMP collateral left in the pair was effectively wor…

Kashi is SushiSwap's BentoBox-based money market: each lending market is a thin KashiPairMediumRiskV1 clone that takes one collateral token and lends one asset token, wi…

Aventa / IntelliQuant reward-claim drain — claim size is computed from a spot, attacker-controllable token balance

Loss · ~16,019,528 AVENTA (≈ 16.0 M tokens), monetised to ~3.9 ETH by the PoC batch of 12 helper…

AventaRewardClaim.claim(user) is meant to pay AVENTA rewards to existing IntelliQuant holders. The amount it pays is IntelliQuant.balanceOf(user) read at call time — not…

BITDOG token — public `changeRouterVersion` hijacks swap router & drains contract BNB

Loss · 2.101368297037048768 BNB (~2.10 BNB)

BITDOG is a fee-on-transfer BEP-20 that holds its collected swap fees in BNB inside the token contract itself. When any transfer pushes the contract's own token balance…

Blueberry HyperVaultRouter — missing asset index check mints shares for any token

1. deposit(asset, amount) looks up assetIndexes[asset] and requires _isAssetSupported. 2. Unregistered tokens return mapping default 0, and USDC is hardcoded as index 0.…

Blueberry TVL share inflation — AuditVault 61480

TVL excludes in-flight assets, so a deposit mints twice the fair share amount.

BTNFT Exploit — Permissionless Reward Theft via a Broken `_update` Override

Loss · 19,025.92 BUSD received by the attacker (19,158.41 BTT reward drained, then dumped)

BTNFT is an ERC-721 (OpenZeppelin v5) where each NFT carries a 1-year linear vesting schedule of BTT tokens. To let an owner "redeem" an NFT's vested rewards, the contra…

Burve — Incorrect handling of ERC4626 vaults with fees

1. Pool deposits user tokens into an ERC4626 that takes a 1% deposit fee. 2. Protocol still credits full value despite fewer shares minted. 3. User withdraws full credit…

Burve — Incorrect tax distribution when adding value single-sided

1. Single-sided adds charge a tax meant for existing LPs. 2. valueStaked is incremented before tax is written into earningsPerValueX128. 3. New LP is already in the deno…

Burve — Reserve share overflows due to strict reward calculation

1. ReserveLib.deposit mints shares as amount * shares / balance. 2. Dust residuals leave balance tiny while amount > 0 still mints. 3. Repeated inflation drives shares n…

Burve H-6: fee bypass in `ValueFacet.removeValueSingle` (variable used before assignment)

Burve: an attacker captures unclaimed fees by timing a deposit around range re-entry

FlyLong (FLG) — public balance-forger lets any caller fake the LP's token balance and drain the WBNB side of the pair — access-control/missing-auth

Loss · ~1.73 BNB (PoC extracts 1.7258625 BNB; ~1 BNB of dust remains in the pair as 0.0001726035…

FlyLong is an obfuscated BSC ERC-20 whose code keeps a custom liquiditySwapFrom mapping as its "real" balance ledger (balanceOf just reads it). Two of its functions are…

Forte Float128 — [H-01] Early 72-digit adjustment in sqrt wrong exponent

1. Large-path sqrt computes a 73-digit rMan via Uint512.sqrt512. 2. The code trims to 72 digits (rMan /= 10; ++rExp) before rExp /= 2. 3. Integer division drops the +1 (…

Forte Float128 — [H-02] Sqrt silently stops the entire call frame on packed 0

1. Mathematically, sqrt(0) = 0. 2. Float128 uses assembly stop() on packed zero — equivalent to return(0,0) for the entire call frame. 3. Because sqrt is internal pure,…

Forte Float128 — [H-04] eq ignores L_MANTISSA_FLAG / dual encodings

1. Mantissas may be M (38 digits) or L (72 digits); the L flag is bit 241 of the packed word. 2. eq only checks unwrap(a) == unwrap(b). 3. 1.0 encoded as L (1e71 10^-71)…

Forte Float128 — [H-05] Precision loss in toPackedFloat for mid-range mantissas

1. Mantissas with 39–71 digits sit between M-max (38) and L-min (72). 2. toPackedFloat decides M vs L from the exponent alone. 3. For 2^235 with exponent -51, the encode…

Impermax V3 Exploit — Self-Liquidation Debt Wipe via `restructureBadDebt`

Loss · ~$300k total (per QuillAudits / SlowMist). This single reproduced run nets 34.60 WETH ≈ $…

Impermax V3 lets you deposit ERC-20s into a Borrowable pool (you get pool shares whose value is (cash + outstandingDebt) / totalSupply) and borrow against a tokenized Un…

Kinetiq — `receive()` re-stakes Core-returned HYPE and bricks confirmWithdrawal

1. On HyperEVM, HYPE is the native gas token. Undelegations from Hypercore arrive as native ETH-like transfers to StakingManager. 2. receive() external payable { stake()…

Laundromat Exploit — Free Ring-Membership Drains a Dormant Mixer

Loss · ~$1.5K — 1.0 ETH (the entire pool, deposited by one honest participant)

Laundromat is an ancient on-chain mixer that implements a linkable ring signature (the academic "Möbius"/ring-signature ETH-mixing scheme). It is parameterised by a fixe…

Level zero heartbeat blocks claims — AuditVault 63737

A zero heartbeat is treated as an invalid oracle state and causes every reward claim to revert.

Life Protocol Exploit — Asymmetric Bonding Curve: Pump the Buy Price, Dump at 90% of the Peak

Loss · ~18,045 BUSD drained in the reproduced transaction (the original incident is reported at…

LifeProtocolContract is a "bonding-curve"-style market maker for the LIFE token, priced in BUSD. It keeps a single mutable currentPrice (:1071).

MultiTransferSwap ETH refund drain — loop-accumulation bug lets attacker reclaim msg.value against the contract's own balance

Loss · ~0.339 ETH (339,014,011,988,554,657 wei) drained from the contract; attacker net ~0.3366…

MultiTransferSwap is a thin Uniswap-V2 wrapper that lets a caller swap ETH for an exact amount of some output token, repeated times times in a single call. The author me…

R0AR (1R0R) Staking Exploit — Backdoored `user.amount` + Self-Capping `EmergencyWithdraw()` Drain

Loss · ~$777K — 100,000,000.0999 1R0R + 26.777 R0AR/WETH LP tokens drained from the staking cont…

R0ARStaking is a single-pool staking contract: users stake R0AR/WETH LP tokens and accrue 1R0R rewards. It exposes three withdrawal-ish paths: withdraw(), harvest(), and…

tCDP `transferFrom` allowance-swap bug drains holders' tokens — ERC-20 `transferFrom` debits the wrong allowance slot

Loss · ~2.02 ETH (the attacker's net profit after the 0.1 ETH seed); see output.txt:1565

tCDP is an ERC-20 wrapper token for a leveraged ETH/DAI "CDP" position held on Compound — holding tCDP entitles the owner to a proportional slice of the contract's cETH…

Unverified `0x607742A2` Exploit — Permissionless `uniswapV3SwapCallback` Approval Drain

Loss · ~$62.3K — 22.51 WETH + 27,260 USDC drained from a single approving wallet

The contract at 0x607742A2 is a generic "router/swap-executor" helper that interacts with Uniswap-V3-style pools. It implements uniswapV3SwapCallback(int256 amount0Delta…

Virtuals — new validator receives historic voting credit and the full reward

A validator score should count actual engagement. When a validator is initialized, the audited code assigns its base score to the total number of past proposals. That ma…

Virtuals — public impact recalculation redirects reward allocation

Impact values determine the allocation used to mint rewards. updateImpact is public, and it persists a recalculated allocation using the current datasetImpactWeight. Aft…

Virtuals — stale `promptMulti` cache burns and misroutes user payments

promptMulti tries to cache an agent token-bound account for consecutive identical agent IDs. It loads an address when the ID changes, but never assigns the new ID to pre…

Virtuals Protocol — anybody can control a user's delegate via `AgentVeToken.stake()` with 1 wei

1. AgentVeToken.stake(amount, receiver, delegatee) mints amount veToken to receiver, then unconditionally calls _delegate(receiver, delegatee). 2. Only the caller's own…

YB Token Exploit — Sell-Triggered Uncompensated Pool-Reserve Burn (`sync()` price manipulation)

Loss · 15,261.68 BUSD (~$15.3K) drained from the YB/BUSD PancakeSwap pair

The YB token's transfer-fee machinery burns YB directly out of its own AMM pair's balance and then calls pair.sync() on every taxed sell. The relevant call lives in swap…

YieldFi CCIP: every inbound message reverts when decoded (`uint32` vs `uint64` chain selector)

YieldFi CCIP: missing source validation lets an untrusted chain drive privileged mint/unlock

YieldFi YToken: wrong `owner` (`msg.sender`) passed to `Manager.redeem` in delegated withdrawals

0x MainnetSettler Exploit — Arbitrary `transferFrom` via the BASIC Action's `sellToken == address(0)` Confused-Deputy Fall-Through

Loss · 3,008 USDT (3,008,000,000 raw, 6 decimals) — lifted from the victim's USDT balance via US…

1. The 0x MainnetSettler.execute(AllowedSlippage, bytes[] actions, bytes32 zidAndAffiliate) entry point is takerSubmitted — i.e. the caller (msg.sender via the transient…

1inch Fusion V1 `Settlement` Exploit — Yul Calldata-Length Underflow Hijacks the Resolver Dynamic Suffix

Loss · ~$4.5M across affected resolvers (this PoC reproduces 1,000,000 USDC drained from a singl…

1inch Fusion's Settlement contract fills Fusion orders by calling the Aggregation Router V5's fillOrderTo, and appends a "dynamic suffix" (totalFee, resolver, token, rat…

540 seconds is used instead of 540 days — AuditVault synthetic reduction

The report discusses a bug found in the Superfluid locking contract, where the function _getUnlockingPercentage() incorrectly uses the number 540 instead of 540 days, le…

Alkimiya SilicaPools Exploit — `uint128(shares)` Truncation Inflates Redemption Payout

Loss · ~$95.5K — 1.14015390 WBTC drained from the SilicaPools contract

SilicaPools issues paired ERC-1155 long and short tokens against collateral. The amount of collateral and the per-pool sharesMinted accumulator are tracked in uint128 st…

BBX Token Exploit — Stuck Daily-Burn Repeatedly Drains the Pool's BBX Reserve

Loss · ~11,673.92 BUSD (≈ $11,902) drained from the BSC-USD/BBX PancakeSwap pair

BBXToken's _transfer override contains a "daily deflation" feature: once a day, it burns burnRate (3%) of the liquidity pool's BBX balance directly out of the pair and t…

Biconomy Composability — [C-01] Missing DelegateCall check

1. executeComposableDelegateCall is meant only via smart-account CALLTYPE_DELEGATECALL. 2. There is no check that address(this) differs from the module’s immutable deplo…

Blueberry approved withdrawal drain — AuditVault 61458

requestRedeem debits escrow without checking that the caller is an approved withdrawal owner.

Burve — DoS on `mint()` and `burn()` due to overestimation of available liquidity

1. Every mint/burn runs compoundV3Ranges → collectAndCalcCompound. 2. With 2 equal ranges and 1 wei residual, nominal liq is computed as 14. 3. Real mintable liquidity i…

Burve — First deposit front-running attack

1. Alice mints 1 wei liquidity → 1 share (no dead shares). 2. Alice donates 1e18 of liquidity tokens, inflating totalNominalLiq. 3. Charlie mints 2e18 → shares = 2e18 *…

DCF Token Exploit — Transfer-to-Pair Reserve Burn Inflates DCF Price

Loss · ~442,028 BSC-USD (~$442K) drained from the DCF/BSC-USD and DCT/BSC-USD PancakeSwap pairs

DCF is a "deflationary" ERC20. Its overridden _transfer (contracts_DCF.sol:124-165) contains a hook that fires whenever someone transfers DCF to the liquidity pair. In t…

DIA Spectra — fee dropped during the interchain oracle callback (permanent DoS)

OracleRequestRecipient.handle() is the destination-chain entrypoint the Hyperlane relayer calls to deliver an inbound oracle request. To answer it, handle() dispatches a…

DUCKVADER Exploit — Permissionless Free-Mint via Broken `buyTokens()` + Storage Shadowing

Loss · ~5 ETH total in the live attack (200 mint-loops). The extracted PoC uses 10 loops and sti…

DUCKVADER's buyTokens(uint256 amount) is supposed to be a paid mint endpoint. It is catastrophically broken in three independent ways (Contract.sol:700-712):

ERC-20 fees are permanently locked in Treasury — frozen funds

Loss · ERC-20 fee balances sent to Treasury cannot be recovered

The Treasury exposes a native-ETH withdrawal only. ERC-20 fee tokens accumulate at the contract and the attempted token recovery selector reverts, leaving the balance fr…

H2O Token Exploit — `skim()`-Triggered Self-Minting Reward Drain

Loss · 22,470.89 USD (≈22,470 BSC-USD), drained from the H2O contract's own reserve via the H2O/…

H2O is a "reflection"-style token. On every transfer where the sender is the AMM pair, it runs a hidden reward routine _calulate() (Token.sol:509-562) that (a) mints sid…

InfiniFi — Referencing the gateway balance in `increaseUnwindingEpochs` can DoS the function

1. LockedPositionTokens are transferable until used to vote. 2. Bob transfers his position tokens to the gateway. 3. Alice deposits her own shares and approves only her…

InfiniFi — StakedToken holders can circumvent restriction by approving another address to withdraw

1. Alice holds siUSD and is action-restricted (cannot transfer/withdraw). 2. Alice approves an unrestricted third party for her shares. 3. Alice's own withdraw reverts w…

Kinetiq LST — precision truncation on stake causes accounting insolvency

1. HyperCore books HYPE with 8 decimals → transfers must be multiples of 1e10 wei. 2. _distributeStake sends truncatedAmount = amount / 1e10 * 1e10 but recordStake mints…

PTM (Phoenix To Moon) token — public `addLiquidity()` lets anyone spend the token contract's own PTM/USDT into the LP

Loss · 552.63 USDT (≈ $553) net profit to the attacker [output.txt:1564-1565]

PTM ("Phoenix To Moon") is a BSC reflection/dividend token whose fee machinery siphons part of every transfer into the token contract itself (address(this)): a 0.5% liqu…

Pump / TiPTAG Token Exploit — Permissionless Pre-Listing Liquidity Seeding Drains the Bonding-Curve Listing

Loss · ~11.29 BNB (~$6.4K) — net profit, drained across 4 Pump/TiPTAG tokens in one tx

The Pump (TiPTAG) launchpad mints tokens that live on a bonding curve until enough is sold, at which point buyToken() auto-lists the token by dumping liquidityAmount (20…

RnsPay arbitrary `dexRouter` call drains any token a victim approved to the protocol — attacker-supplied exchange target lets `pay()` execute `transferFrom` against arbitrary victims

Loss · 1,050 USDC (~$1,050), laundered to 0.4632 ETH via Uniswap V2 output.txt:1565

RnsPay is a payments contract intended to route a user's payment token through a DEX and forward the converted receipt token to a merchant. To support that, its pay() fl…

SamPrisonman (SBF) Exploit — Externally-Controlled Balance Write Lets an Attacker Zero the AMM Pool Reserve

Loss · ~$14K — 6.5793 WETH drained from the SBF/WETH Uniswap V2 pair

SamPrisonman is a "SBF / Sam Prisonman" meme token whose ERC20 _transfer does not decrement the sender's balance the normal way. Instead it makes an external call to a h…

SBR Token Exploit — `skim()` + broken token `transfer` zeroes a Uniswap-V2 reserve

Loss · ~8.495 ETH (8,495,031,867,920,840,930 wei) — the entire WETH side of the SBR/WETH pool

The SBR token has a broken transfer implementation: calling transfer(x, 0) (or otherwise transferring out a tiny/zero amount) wipes the entire balance of the caller inst…

SIR (Leverage) Exploit — Dirty Transient-Storage Slot Turns `uniswapV3SwapCallback` Into an Open Drain

Loss · ~$353.8K — 17,814.86 USDC + 1.4085 WBTC + 119.87 WETH drained from the SIR Vault singleton

SIR's Vault uses EVM transient storage (EIP-1153, tstore/tload) as scratch space during a leveraged mint:

StackMarket graduated-account flash-loan drain — buy path swaps a Uniswap V3 pool with caller-controlled (zero) slippage, then unwinds at the inflated pool price

Loss · 0.56 WETH (per @KeyInfo; single-attack tx magnitude)

StackMarket is a Base bonding-curve launchpad: every "account" gets its own ERC-20 (StackToken) that trades on an internal AMM (BondingCurve, y = A·x²/B) until 50 % of t…

SWT token burn-then-sync drain — permissionless `burn(address,uint256)` desyncs an AMM pair's reserves before `sync()`

Loss · ~0.40 WAVAX (the pair held ~0.8957 WAVAX; attacker netted ~0.3957 WAVAX after a 0.5 AVAX…

SWT is an unverified ERC-20 on Avalanche paired against WAVAX in a standard Uniswap-V2-style AMM (0x8234…c5CF). The token ships a burn(address from, uint256 amount) func…

SXT — [C-01] Accepting duplicate signatures from one signer

Threshold = 2. Attacker submits the same valid (v,r,s) twice. Both recover to one attestor; both count. validateMessage returns true.

Unlocking percentage formula applies an 80% penalty — AuditVault synthetic reduction

The bug report discusses an issue with the FluidLocker::_getUnlockingPercentage() function in the Superfluid locking contract. The function incorrectly divides one of th…

Unverified `swapit()` helper — public function lets anyone trigger a contract-owned USDC swap through the same AMM pool, harvesting the price impact

Loss · 980.32 USDC (~$980) drained from the vulnerable swapper's own balance

The victim is a small, unverified "swap helper" contract holding a USDC balance and bound to the OFFICIALYE token (a low-cap Base memecoin, 0xedb54f9ffA78f0A0d50dC0c1534…

wkeyDAO Exploit — Fixed-Price Presale `buy()` vs. Live AMM Price Arbitrage

Loss · ~$767 realized net (one attack tx)

WebKeyProSales is a presale contract. Calling buy() (contracts_webkey_Sales.sol:119-170) charges a fixed currentSaleInfo.price of 1,159 BUSD and immediately mints + tran…

Yzi AI (YziAI / YziLabs) Exploit — Hard-Coded `manager` Backdoor in `transferFrom`

Loss · ~376.07 BNB (≈ $222K @ ~$590/BNB) — the entire WBNB side of the YziAI/WBNB PancakeSwap po…

YziLabs is a vanilla-looking OpenZeppelin ERC20 with a booby-trapped transferFrom. The override contains a magic-number branch:

`0xD4F1…7Cb3` Exploit — Uninitialized `OwnableUpgradeable` Lets Anyone Become Owner and `withdrawFees()`

Loss · 23.00702629 BNB ≈ $15.2k (entire native balance of the contract)

The contract at 0xD4F1…7Cb3 is a PancakeSwap V2/V3 arbitrage / swap-helper bot built on OpenZeppelin's upgradeable base contracts (Initializable + OwnableUpgradeable). I…

BankX Router — `swapXSDForETH` Reentrancy (BSC focus)

Loss · ~$43K across BSC + ETH + Optimism

swapXSDForETH pulls amountInMax XSD into the pool (not the quoted amount), swaps WETH out, unwraps, and safeTransferETHs to msg.sender before burnpoolXSD(amountInMax/10).

Blend v2 — Steal other users' emissions via vulnerable claim

1. execute_claim can deposit exchanged backstop LP to a different to address. 2. It updates to's share balance without update_emissions(to). 3. A fresh to later claims w…

Bybit Cold-Wallet Heist — `DelegateCall` masterCopy Overwrite of a Gnosis Safe

Loss · ~$1.46–1.5B — 401,346.77 ETH + 8,000 mETH + 15,000 cmETH + 90,375.55 stETH drained from B…

This was not an exploit of a flaw in the Gnosis Safe contracts. The Safe behaved exactly as designed. It was a supply-chain / signing-infrastructure compromise: the atta…

Four.meme Launchpad Exploit — Liquidity Migration Front-Run via Pre-Initialized Pancake V3 Pool

Loss · ~$186K total across ~20 meme tokens. This PoC demonstrates one token (snowboard): 23.4259…

Four.meme is a "pump.fun"-style launchpad: users buy a meme token along a bonding curve, and once market cap hits a graduation threshold (~24 BNB) the platform "migrates…

GMT7 Helper permissionless drain — unverified trading bot helper exposed public buy/sell functions with no access control and infinite router approval

Loss · 16.75 BNB (~$10.1k at the time; PoC final balance 16.791444737752979201 BNB [output.txt:1…

GMT7 is a low-liquidity BEP-20 token paired with USDT on PancakeSwap (0x5317545A…3006). The project deployed an off-the-shelf "robot" helper contract (0x9AD9…31E3, unver…

GoldReserve NFT profit double-claim — ERC1155 transfer resets the per-address profit accumulator

Loss · 12.74 BNB (≈ $7.3k at the time)

GoldReserve is an ERC1155 NFT collection that distributes native-BNB "profit" to its holders. Anyone can call depositProfit{value} to push BNB into a profit pool; the po…

Hegic V8888 Put Pool Exploit — Re-withdrawable Liquidity Tranche (`withdrawWithoutHedge`)

Loss · ~$104M reported total drain of the Hegic V8888 pools; this PoC mechanically reproduces th…

HegicPool.withdrawWithoutHedge(trancheID) lets a tranche owner redeem their pool share for the underlying token. The redemption logic in _withdraw (contracts_Pool_HegicP…

HenloKart native-token drain — zero-value race commitment funded from the victim balance, then immediately cancelled back to the attacker

Loss · 0.59 ETH (reported in @KeyInfo)

HenloKart is an on-chain hamster-racing game (HenloKart) built as a UUPS-upgradeable proxy on Base. Players "commit to a race" by depositing a bet token (ETH or an ERC-2…

INVISTECH buy-tax drained the AMM pair — fee-on-transfer tax charged from the pair's own reserves on every buy, breaking the constant-product invariant

Loss · ~5.14 BNB (5.137937396574487084 WBNB net profit to attacker) [output.txt:1564-1565]

INVISTECH (INVT) is a fee-on-transfer BEP-20 on BSC paired with WBNB in a PancakeSwap V2 pool. Its custom _transfer charges a tax whenever either side of a transfer is a…

Kinetiq — Exchange rate calculation is incorrect

1. Multiple StakingManagers share one ValidatorManager (global rewards/slashing) and one kHYPE. 2. Each manager stores local totalStaked / totalClaimed. 3. getExchangeRa…

Kinetiq — Exchange rate implementation not used in token operations

1. getExchangeRatio / kHYPEToHYPE / HYPEToKHYPE implement NAV-based rates. 2. stake() still does kHYPE.mint(msg.sender, msg.value) (1:1). 3. Withdraw pays 1 HYPE per kHY…

Kinetiq — Funds can be permanently locked due to unsafe type casting

1. L1Write.sendTokenDelegate takes uint64 amount. 2. StakingManager casts uint256 → uint64 without SafeCast. 3. For amount = type(uint64).max + 1, the cast becomes 0. 4.…

Kinetiq — Some stakers may fail to withdraw staking HYPE

1. Stake path fills hypeBuffer up to targetBuffer before delegating. 2. queueWithdrawal never spends the buffer; it always undelegates from currentDelegation. 3. After a…

OpenOcean Limit Order Protocol — unrestricted `transferTokens()` drains any pre-approved maker

Loss · 2,800,000 BRAINS (victim's full balance; 2.8e24 wei / 18 decimals) — see output.txt:1624

OpenOcean's Base deployment of the Limit Order Protocol v2 is an upgradeable contract: a TransparentUpgradeableProxy (0xb5486f71…) delegates to an implementation (0xCe8D…

Optimism Interop — malicious tokens at deterministic addresses steal cross-chain funds

1. Superchain tokens are deployed through a generic CREATE2 factory that exists at the same address on every interop chain. A token's address therefore depends only on (…

Peapods Finance Exploit — Permissionless `depositFromPairedLpToken()` Forced Swap at Manipulated Spot Price

Loss · ~$3,500 — 141.11 pOHM drained from the protocol's TokenRewards contract + the pOHM/PEAS U…

Peapods TokenRewards periodically converts the paired LP token it accumulates (here pOHM) into the rewards token (PEAS) and distributes the proceeds to stakers. That con…

Recall — [H-01] Missing signature duplication check in submitCheckpoint

Single weight-6 validator forges majority quorum by repeating itself in signatories[]

Recall — [H-04] Overflow count of messages in bottom-up batch

Overpopulated cut batch permanently fails ensureValidCheckpoint — bottom-up halt

Recall — [H-05] Incorrect supply fund transferral in leave()

leave() pays genesisBalance as ETH collateral instead of supply ERC20 — drains other validators

Recall — [H-06] Reentrancy in leave() leads to halting of bottom-up checkpoints

Reentrancy via genesis ETH refund + unguarded stake() bootstraps mid-leave; confirmDeposit reverts forever

Recall — [H-07] Incorrect loop indexing in compact()

while (i pending length — claimable collateral locked

Recall — [H-09] Cross msg recipient can block checkpoint submission

Unbounded returndata from IPC recipient gas-bombs checkpoint execution under remaining gas

Roots — [H-01] Overwriting collateral breaks collateral gains logic

1. Alice accrues coll-A gains on stability-pool index 0 and leaves them unclaimed. 2. Coll A is sunset; coll C is enabled and reuses index 0. 3. Product sums for index 0…

Scorch OTC `scorch()` drains ETH via manipulated spot `getAmountsOut` quote — on-chain price manipulation in a burn-for-ETH function

Loss · ~0.14 ETH on-chain (public report); 0.337 ETH reproduced in the offline fork trace [outpu…

Scorch (OTC) is an ERC-20 whose contract holds an ETH treasury. Its scorch(amount) function lets any holder burn their OTC tokens and receive ETH directly from the contr…

StepHeroNFTs Exploit — Reentrancy in `claimReferral()` Drains the Marketplace's BNB

Loss · 137.9 BNB (~$92K at the time) net profit, drained from the marketplace contract's BNB bal…

StepHeroNFTs is an NFT marketplace that pays referral commissions in native BNB. When an NFT is sold, a fixed commission (here 3 BNB) is credited to a "referral balance"…

THORWallet — Bridge path bypasses TITN transfer lock — send to any address

Bridge path bypasses TITN transfer lock — send to any address. Harm demonstrated: Transfer-lock invariant broken: bridge credits tokens to arbitrary recipient.

THORWallet — MergeTgt has no deposit cap vs TGT_TO_EXCHANGE — late claimers stuck

MergeTgt has no deposit cap vs TGT_TO_EXCHANGE — late claimers stuck. Harm demonstrated: Over-subscribed TGT deposits leave late claimers unable to redeem TITN.

Treasury Vesting — `batchRelease` updates state before transfer, users get nothing

1. Loop 1: for each user, compute releasable, add to userReleased / totalReleased. 2. Loop 2: recompute releasable — now 0 because loop 1 already credited releases — ski…

Unverified "Slot" Staking Contract — `releaseSlot()` Reentrancy BNB Drain

Loss · ~$6,700 — 10.2 BNB drained from the contract's native balance (attacker walked off with 1…

The contract is a BNB "slot" staking / lottery product. A user calls unlockSlot(uint256) with BNB to activate a slot, and later calls releaseSlot(uint256) to get their d…

Venus (zkSync Era) Exploit — wUSDM ERC4626 Donation → Oracle Price Inflation → Self-Liquidation Drain

Loss · 86.72 WETH ≈ $201,600 extracted by the attacker (paid as a Venus self-liquidation drain).…

Venus's zkSync deployment listed wUSDM (an ERC4626 wrapper over the USDM stablecoin) as a market. wUSDM's USD price is computed by Venus's ERC4626Oracle, which simply re…

98Token ("98#") Exploit — Unprotected `public swapTokensForTokens()` Drains the Contract's Token Reserve

Loss · ~$28K — 27,995.39 USDT swept out of the USDT/98# PancakeSwap pair

The Main contract is a "car-racing / guild" GameFi app whose reward token is 98#. To run its game economy it embeds thin wrappers around the PancakeSwap router and, in i…

Abacus clearUnusedBond drains credits — AuditVault 48699

clearUnusedBond lacks the bond-owner restriction and can erase all outstanding credit bonds.

Abacus past-closure adjustment bypass — AuditVault 48701

adjustTicketInfo does not reject a ticket whose closure has already been finalized.

Abacus tokenMapping inconsistency — AuditVault 48698

The registration path writes tokenMapping but updates a different existence key, so lookups disagree.

Abacus transferFrom drops locked ether — AuditVault 48700

Position ownership moves without moving the corresponding ethLocked amount.

AI IPC Token Exploit — Sell-Triggered Pool Burn (`_destroy`) Drains the AMM Reserve

Loss · ~591,933 USDT (~$590K) drained from the IPC/USDT PancakeSwap pair

Token ("AI IPC") is a deflationary token with a "destroy → reproduce" mechanic. On every sell (an IPC transfer into the IPC/USDT pair), the token's _transfer hook calls…

AIXBT Forced-Swap Exploit — Public "Auth-Key" Selector Swaps Victim's Whole Balance into Attacker LP

Loss · 13,598.795675 USDC (13,598,795,675 raw, 6-dec) drained from the victim — tx 0x5a7462b79d6…

1. The victim contract 0x32cD8541… exposes a public function with selector 0x229e9756 that, when called with the right key, approves its entire token balance to the Unis…

Any attempt to liquidate a user will fail — StabilityPool never holds crvUSD

1. Operational deposits route crvUSD into the reserve, never into the StabilityPool. 2. A borrower has outstanding debt and should be liquidatable. 3. liquidateBorrower…

AST Token Exploit — Faulty `transfer` Liquidity-Tracking Burns Pool Reserves Twice

Loss · ~$65,000 — 65,145 BUSD drained from the BUSD/AST PancakeSwap pair

AST is a fee-on-transfer token that tries to detect liquidity adds/removes by watching balances inside its own _transfer hook. The detection logic is broken in two compo…

Burve SimplexDiamond — Unrestricted `diamondCut` allows unauthorized facet modifications

1. SimplexDiamond exposes diamondCut without AdminLib.validateOwner() (or any auth). 2. Any address can add/replace/remove facet selectors. 3. Attacker adds a drain face…

collect() trusts an arbitrary DAO contract — AuditVault synthetic reduction

The report describes a high-risk bug in the DaosLocker::collect() function, which can be exploited by a malicious actor to steal swap fees from legitimate DAOs. This can…

DESK / HMX — Incorrect margin calculation due to inconsistent realized and unrealized balances

1. Liquidation margin = getSubaccountTotalMargin (realized, CF already applied) + unsettled PnL. 2. Unsettled PnL only gets the collateral factor when positive; negative…

Etherspot CredibleAccountModule — [H-01] no check for `userOp` / `userOpHash` mismatch nor sender validity

1. validateUserOp(userOp, userOpHash) derives sessionKeySigner from userOpHash and validates params against userOp. 2. There is no check that userOp.sender == msg.sender…

Etherspot CredibleAccountModule — session owner can consume a sibling session

The module verifies that a signer belongs to the smart wallet but never checks that the session named in claim() is the same signer. One active session key can therefore…

Etherspot CredibleAccountModule — session-key approval drains the wallet

Session-key call validation allows any ERC20 approve target. The key owner chooses itself as spender, then calls transferFrom to remove every token held by the smart wal…

Etherspot GasTankPaymaster — user withdraws before sponsored gas repayment

postOp records a user's gas debt, but withdraw remains unrestricted. The user can empty the GasTank before the asynchronous repayment job runs, leaving the paymaster una…

Etherspot ResourceLockValidator — replayable signature proof

The validator checks a ResourceLock Merkle proof but never consumes it. EntryPoint can therefore submit the same call data with a different nonce, and the wallet execute…

EYWA EscrowManager reentrancy — AuditVault 44334

Escrow performs the external receiver callback before its accounting transition, allowing nested withdrawals.

EYWA EscrowVoteManager poke DoS — AuditVault 44337

poke accepts a token ID owned by another account and lets an untrusted caller poison vote state.

Folks Finance borrow balance omits interest — AuditVault 61079

getLoanLiquidity reports only principal and drops accrued interest from the borrow balance.

Folks Finance loan-health underestimation — AuditVault 61051

The health calculation overstates collateral capacity and permits an outsized loan for a minimal deposit.

Folks Finance mixes stable and variable debt — AuditVault 61091

Liquidation merges stable debt into the variable bucket, changing the borrower’s debt semantics.

HORS Exploit — Unprotected, Attacker-Callback `0xf78283c7` Drains the Pool's LP Tokens

Loss · 14.799349453861436868 WBNB (~$10.4K at ~$700/BNB on the day) — the entire HORS/WBNB liqui…

The HORS project deployed a helper contract at 0x6f3390…eaba that custodied the LP tokens of the HORS/WBNB PancakeSwap v2 pair. That contract exposes a function with sel…

IPSeed tokenId reconfiguration drain — AuditVault 31585

A caller can reconfigure tokenId and withdraw ETH belonging to the previously configured asset.

IQ AI — Adversary can win proposals with voting power as low as 4%

1. Constructor sets GovernorVotesQuorumFraction(4) with comment "quorum is 25% (1/4th)". 2. OZ quorumDenominator() defaults to 100, so quorum = supply * 4 / 100 = 4%. 3.…

JPulsepot / FortuneWheel Exploit — Permissionless `swapProfitFees()` + Spot-Price Fee Sizing

Loss · ~$21.5K — 30.968 WBNB profit, extracted from the FortuneWheel casino's accumulated fees /…

FortuneWheel is an on-chain casino. House profit accumulates per game in various tokens. A maintenance routine, swapProfitFees() (contracts_FortuneWheel_FortuneWheel.sol…

Karak increaseBalance share loss — AuditVault 38492

increaseBalance rounds the minted share amount down by a factor of two.

LAURA Token Exploit — Permissionless `removeLiquidityWhenKIncreases()` Reserve Burn

Loss · 12.340357077284305206 ETH (~$41.2K) drained from the LAURA/WETH Uniswap-V2 pair

LAURA (deployed by a pump.fun-style launchpad as a PumpToken) has a public, unprotected function removeLiquidityWhenKIncreases(). It reads the LAURA/WETH pair's reserves…

Liquid Ron — totalAssets wrong when operatorFeeAmount > 0

1. Operator fee sits in the vault balance and is tracked in operatorFeeAmount. 2. totalAssets() still counts that fee toward share pricing. 3. New depositor mints fewer…

LPMine Exploit — Reward-Time Desync + Pool-Balance Reward Valuation Drains the Reward Pool

Loss · ~$24k — net +23,293.95 USDT to the attacker; the LPMine reward pool was drained of ≈402.2…

LPMine is a "stake-LP, earn-tokens" farm. A staker's claimable reward is computed in getCanClaimed() as

MCAI tax-wallet allowance bypass — privileged `transferFrom` drains the Uniswap V2 pair

Loss · ~12.03 WETH / ETH (12.028506355387210510 ETH extracted by the attacker EOA)

Memecast AI (MCAI) is a generic fee-on-transfer meme token with a Uniswap V2 MCAI/WETH pool. Its ERC-20 transferFrom does not enforce the spender allowance in the normal…

Mismatching data location during inheritance — AuditVault 50685

The inherited handler stores a calldata payload through an incompatible data-location boundary.

Mosca Exploit — `exitProgram()` Pays Out Internal Credit That Was Never Backed by a Deposit

Loss · ~$19K combined — both stablecoin sides of the contract were drained. The PoC's USDC-only…

Mosca is an MLM-style "citizenship" program that keeps per-user internal balances in three fields — balance (MOSCA credit), balanceUSDT, balanceUSDC (Mosca.sol:175-187).…

Mosca Exploit — Self-Compounding `join()` Balance Inflation Drains the Treasury

Loss · ~$37.6K — 11,395.25 BUSD + 26,254.20 USDC drained from the Mosca contract

Mosca is an on-chain MLM / "membership" program. Members join() by paying USDT (BUSD on BSC) or USDC, in exchange for an internal credit (users[me].balance) that they ca…

Next Generation — Cross-chain signature replay via user-supplied domainSeparator

_verifySig takes domainSeparator from the caller. Two chain deployments both accept the same domain label; independent nonces allow draining EURF on each chain under tha…

Notional v4 — redeemNative reentrancy freezes yield tokens

redeemNative snapshots balance, swaps via a path including a malicious token that reenters initiateWithdraw (moves N yield tokens and decrements accounting). After retur…

Odos Limit Order Router Exploit — Public ERC-6492 `isValidSigImpl(... allowSideEffects = true)` Arbitrary-Call Drain

Loss · 15,578.334373 USDC (≈ $15.6K) drained from the router; total campaign across chains repor…

The Odos limit-order router inherits the Ambire UniversalSigValidator implementation of ERC-6492 ("Signature Validation for Predeploy Contracts"). ERC-6492 lets a not-ye…

OpenTrade rollover loan-address validation — AuditVault 47890

The rollover entry point accepts an arbitrary loan address instead of validating pool ownership.

Paribus Exploit — Algebra/Camelot LP-NFT Collateral Priced from Manipulable Spot Price