Hacks

Reproduced Exploits

Root cause, vulnerable code, attack walkthrough, and a standalone Foundry PoC for each incident — an indexed library of reproduced on-chain exploits across EVM chains.

Indexed

761 / 761

Source:Exploit reproductions, traces, and methodology adapted from DeFiHackLabs by SunWeb3Sec.SunWeb3Sec/DeFiHackLabs

761 matching incidents

Oracle ManipulationBNB ChainJun 2026

AISOTH Presale Exploit — Same-Tx Buy+Claim of Below-Market Inventory, Dumped Into the Live AIS/USDT Pair

Loss · 30,314.76 USDT profit to the attacker (30314760842915494215340 wei), extracted from the A…

1. Presale (Presale.sol) sells AIS for USDT at a fixed administrative price of price = 35e15 (i.e. $0.035 per AIS, Presale.sol:58-59). It holds a real inventory of AIS d…

Reproduced Exploits

AISOTH Presale Exploit — Same-Tx Buy+Claim of Below-Market Inventory, Dumped Into the Live AIS/USDT Pair

Ambient (CrocSwap) Exploit — Native-ETH Surplus Settlement Drained via a Self-Dealt Grid-Walk + Range Harvest

ATM LP-Burn Exploit — Misplaced LP Tokens Are Burn-Redeemable by Anyone via PancakeV2 `burn()`

ATM Token Exploit — Per-Address Anti-Whale Guards Sidestepped by 30 Sybil "Farmer" Clones

Aztec Connect (V3) Exploit — `numRealTxs` proof-vs-settlement coverage mismatch

Aztec Escape-Hatch Exploit (variant 2) — Unconstrained Inner `proof_id` Witness

Aztec V1 Escape-Hatch Exploit — Unbacked Withdrawals via Verifier-Trusted Rollup Proofs

BOSS Exploit — Helper Mint/Burn Drains the Pair's BOSS Reserve, then a Degenerate-Reserve Swap Loop Empties the USDT Side

BY Token Exploit — Permissionless `triggerAutoBurn()` Pool-Reserve Drain

DIP Exploit — Fee-on-Sell Transfer + `skim`/`sync` Reserve-Collapse on the DIP/AIC Pair

DLMC Exploit — Reserve-Derived `livePrice` Self-Inflation Drains the Token's Own USDT Backing

DTXT Exploit — 1-Wei USDT Donation Misclassifies a Sell as a Liquidity Add (Fee Bypass + Stale-Reserve Drain)

JB Exploit — Gateway-Driven `sell → PoolBurn(pool) + sync()` AMM-Reserve Drain (Venus-leveraged)

LBP (Little Boy Plus) Exploit — Reserve-Manipulated LP-Credit Inflates Mining Rewards Minted Into the Pool

NovaBox Exploit — Stale Dividend Checkpoint on Join + Constructor `extcodesize` Bypass

OLPC Exploit — Owner `decimalsValue` Misconfig Amplifies Pair-Side Burn → `amountIn=0` Supporting-Fee Drain

RoyalRoyalties Exploit — Zero-Amount ERC-1155 Batch Transfer Inflates `tierBalanceOf` 100×

Thetanuts Exploit — Zero-Cost Index-Vault `mint()` via Rounding-Down Component Deposits

Thetanuts Finance Exploit — Integer-Division Truncation in `mint()` After the Vault Is Drained to ~0 `totalSupply`

TOP Exploit — Aragon Instant-Execution Governance Self-Mint + Balancer BPool Drain

WHALE Exploit — Flash-Inflated AMM Reserve → Mining-Hashrate Over-Credit Drain

Adshares Bridge Exploit — Compromised Minter Key Fabricates Cross-Chain Mints

AROS Exploit — Leaked `claimSigner` Key + AMM-Reserve Drain via Signed Claims

DxSale Liquidity-Locker Exploit — Stealthy Ownership Takeover + Privileged Drain (~$7.3M BNB)

Ekubo Protocol Exploit — Flash-Accounting `pay()` Funded From a Victim's Standing Approval

ElevateFi Exploit — Fixed-USD Staking Packages Priced from Spot DAI/EFI Reserves

Fractal Protocol Exploit — Stale-Price / Retroactive-Yield Arbitrage via Permissionless `compute()`

Huma Finance Exploit — Evaluation-Agent Approval Bypass via `refreshAccount()`

INK Finance Exploit — Flash-Loan-Inflated, Permissionless `claimPayroll()` Treasury Drain

Joe Agent (JOE) Exploit — `removeLiquidityViaContract` Reentrancy on Pooled LP Custody

LegendaryMoneyMonNft Exploit — `cliamRewred()` Signature Bypass via `ecrecover` → `address(0)` == `admin`

MAP Protocol Exploit — Unverified `retryMessageIn` Forges a Cross-Chain Message to Mint 1e33 MAPO

MetaSea (SEA Token) Exploit — `redeemPosition()` Over-Pays From an Unguarded Reward Distributor

Mure Distribution Exploit — Attacker-Controlled `source` Forges Both Verifier and Signature

New Market Trading Exploit — Payload-Forgery Drain via Axelar "Express" Path on a Gnosis Safe Module

Renegade Darkpool Exploit — Re-Initializable Proxy → Attacker-Controlled `delegatecall`

SKP Token Exploit — Owner Backdoor `ownerBurnLiquidityPairTokens()` Reserve Drain → Collateral Price Inflation

SKP/USDT Exit-Scam Drain — Pre-Positioned 96.8%-of-Supply "Whitelist" Treasury + Pool Drain

SQ Token Staking Exploit — Hardcoded Owner Backdoor + Self-Minting Staking Rewards

Squid Router Module Exploit — Caller-Supplied Delegate on the Permissionless Axelar Express Path

TesseraSwap Exploit — CEI Violation: Treasury Pays the Output Token Before Collecting the Input Token

TrustedVolumes Exploit — Permissionless Signer Registration + Wrong-Key Authorization Drains an RFQ Settlement Proxy

Verus–Ethereum Bridge Exploit — Forged Cross-Chain Import With No Source-Amount Validation

WUSD Exploit — Sybil-Farmable `_englove()` Reward Mint + Thin-Pool GLO Drain

YSDAO Exploit — Balance-vs-Reserve "Add/Remove Liquidity" Tax Bypass + Permissionless `Staking.sync()` Price Pump

Juicebox REVLoans Exploit — Trust-on-First-Use of a Caller-Supplied Loan Source Inflates Borrowable Surplus

Kipseli PropAMM Exploit — USD-Scale Quote Misread as cbBTC Token Units

MONA / LisaVault Exploit — Self-Referral Node Farming + Insider LP Drain

PerpPair Exploit — Self-Dealt LP/Trader Pair Inflates Curve-Priced PnL out of the Shared Vault

RWAVault Exploit — Overridden `ERC4626.withdraw` Drops the Allowance Spend

Saturn Protocol (sUSDat) — Withdrawal Freeze via `strcBalance`/`vestingAmount` Desync + 33% PROCESSOR Extraction

Singularity dynBaseUSDCv3 Exploit — `totalAssets()` Inflation via a Mis-Configured (Fee-Tier-42 / Zero-Liquidity) Oracle Path

Squid `SquidMulticall` Exploit — Arbitrary-Target `Default` Call Turns an Approved Multicall into a Universal `transferFrom` Proxy

SubQuery (SQT) Exploit — Unprotected `Settings.setBatchAddress()` Role Hijack

Thetanuts BTC/USD Vault Exploit — ERC4626-Style First-Depositor Share Rounding at `totalSupply() == 0`

xLOOT Staking Exploit — Duplicate NFT IDs in `redeem(uint256[])` Claim the Same Epoch Reward Repeatedly

AlkemiEarn Exploit — Self-Liquidation Storage-Aliasing Collateral Duplication

Curve LlamaLend (Inverse Finance sDOLA market) Exploit — Oracle / Band Manipulation Mass-Liquidation

EST / BNBDeposit Exploit — `skim()`-Fed Proportional Reward Drain + AMM Reserve Manipulation

Venus (vTHE) Exploit — Donation-Inflated Exchange Rate + `borrowBehalf` Drains a Victim's Pre-Approved Delegate

Whalebit Oracle Manipulation Exploit — Spot-Priced Level Staking Round-Trips a Manipulable Algebra Pool

LAXO Token Exploit — Uncompensated Pool-Side Burn on Every Sell Breaks `x·y = k`

Moonwell cbETH Oracle Incident — Mispriced Collateral Enables Near-Free Liquidation

XDK Exploit — Sell-Path "Recycle" Removes XDK from the Live Pair and `sync()`s

FutureSwap Perpetual Drain — Fee Unit-Mismatch (`addFee` token-units interpreted as bps/share)

Makina Finance Exploit — Self-Referential AUM Oracle Manipulation via Permissionless Re-Accounting

MT Token Exploit — Fee-on-Transfer Overcharge Drains the AMM Pair via `skim()`+`sync()`

PRXVT Staking Exploit — Transferable Reward-Receipt Token Resets `userRewardPerTokenPaid`

SynapLogic Exploit — Uncapped Cumulative Refunds in the Token Sale `buy` / `swap` Path

Truebit Exploit — Inverted `getPurchasePrice` Lets Anyone Buy TRU For Free, Then Sell For ETH

yETH Weighted-StableSwap Exploit — Invariant Rounding Drift Mints Unbacked LP

Balancer V2 Exploit — ComposableStablePool Rounding-Error Drain via Rate-Scaled `_upscale`/`_downscale`

DRLVaultV3 Exploit — Self-Referential Slippage Lets a Manipulated Pool Set Its Own "Minimum Out"

Moonwell Exploit — Corrupted wrsETH Oracle ⇒ Borrow ~$88K Against ~$0.07 of Collateral

MIM Spell ("MIMSpell3") Exploit — Collateral-Free MIM Mint from Privileged Cauldrons

Sharwa Finance Exploit — Margin Position Closed Against an Attacker-Manipulated Spot Pool (No Slippage Bound)

TokenHolder / BorrowerOperationsV6 Exploit — Privileged-Role Confused-Deputy Drain via `sell()`'s Arbitrary Call

Kame Aggregator Exploit — Unvalidated `executor.call()` in `swap()` Drains User Approvals

NGP Token Exploit — Sell-Fee Burns NGP *Out of the Pair* and `sync()`s, Collapsing the AMM Reserve

NGP Token Exploit — Sell-Fee Burns NGP Out of the Pair and `sync()`s, Collapsing the AMM Reserve