Hacks

Reproduced Exploits

Root cause, vulnerable code, attack walkthrough, and a standalone Foundry PoC for each incident — an indexed library of reproduced on-chain exploits across EVM chains.

Statistics and quarterly reports

Indexed

2341 / 2341

Source:Exploit reproductions, traces, and methodology adapted from DeFiHackLabs by SunWeb3Sec.SunWeb3Sec/DeFiHackLabs

2341 matching incidents

BNB ChainOct 2026

AlpsCon AI Trade Hub — a public Hardhat address is whitelisted, and a zero entry index pays the historical USDC index

logic/reward-calculationaccess-control/broken-logiclogic/missing-check

Loss · On-chain net 152,295.3625 USDC to the attacker EOA (header of test/AlpsCon_exp.sol). The…

AlpsCon's AI Trade Hub sells ALPS "service credits" and later pays USDC "service results" from a per-share index. Reward entrypoints are gated by onlyVerified, which is…

Reproduced Exploits

AlpsCon AI Trade Hub — a public Hardhat address is whitelisted, and a zero entry index pays the historical USDC index

Argent relay modules — a public owner signature is replayed, and the recovery deadline can be wrapped into the past

BiFi USDT — one idle gap of 264,060 blocks is reapplied at a live utilization the attacker sets

BitBay StableVault — withdraw on an empty position pays the caller the whole vault, uncapped by shares

EtherVista — swap's constant-product (K) check multiplies two uint112 reserves, so the invariant overflows and the pool drains

ETHMACOAPY — a base-set donation makes zero-fee actualizeFee ceil unitShares from 12253 to 12264

Fence tranche pool — the UTC rollover credits a scheduled principal payment that was never paid, and draw pays it again

FlashLoopAdapter — caller self-attests as the Safe, then swapRouter.call runs the victim

GoldPesa GPXHooks — TAKE_PAIR settles the shared unlock, so another position's debt cancels the burn credit

KolanHook — expired buy windows settle on the pool's own spot, then the escrowed ETH is bought back with no price limit

MakerDAO flip-keeper — ungated 0x8804d1de hopes a caller-supplied worker, then exits 200 WETH

MALT sLP — below-peg recovery deposits treasury DAI into the pair, and swap counts it as the caller's input

Safe approval squat — unlimited ERC-20 allowances point at an empty CREATE address anyone can occupy

Set Protocol — zero-fee actualizeFee ceils unitShares from 4927 to 4928 and over-redeems the base set

Slice FundsModule — Unbacked Release From a Caller-Chosen Source

TIPMine — permissionless mine() burns TIP out of the Pancake pair and sync() leaves the SOL reserve in place

UNCX Smart Token Vesting — Shared-Pool Share Double-Debit

X100 Senate — two flash-bought seats pass a same-block vote that dumps treasury X into the attacker's pool

X7 Finance (X7Pioneer) — empty-array claimRewards([]) re-accrues the same donated ETH without advancing the watermark, inflating the per-token reward until one NFT drains the whole pool

Yapeswap — Zero-Quorum Governance Capture, Then a Fake Yearn Vault

zkLink Nova — Transient finalizeMessageHash Reused to Forge a Batch Root

BeatXswap LiquidityVestingConvert — UniV3 slot0 spot oracle

BonfireSwap transfer spends any holder's standing allowance — missing caller check on the router's force-sell

Cozy Finance v2 — UMA Optimistic Oracle fake YES drains the protection Set

DAOstack Genesis Alpha — permissionless newOrganization mints reputation and drains the avatar

DEX router drain — unverified V3 callback trusts a fake pool and transferFroms any approver

DHC Award vault — claimed reward can be reset and paid again from the shared pool

DoinGud acceptOffer pays the escrow twice — amount == 0 skips offer deletion

Enso Finance strategy vault — short Uni V3 TWAP overvalues FARM deposits

ether.fi Liquid / Veda AtomicQueue — Unauthenticated solver Drain

Flamincome — spot-priced, permissionlessly-inflatable strategy NAV drains the proportional-share YUSDT vault

GaslessReservoirEnabler — whitelisted WETH plus arbitrary module.call spends every standing approval

GDCToken — sell-tax credits 30% to the pair then burns 100% from it and sync()s

Internet Token swapV3 mints arbitrary INT to a fake pool — validateSupply is burned around

Likwid leverage == 0 borrow — frozen pair reserves re-quote the same BNB on every collateral add

LPBonus (MSN LP-reward pool) — reserve-inconsistency between reward accrual and withdrawal lets a flash-manipulated reserve inflate an LP's FIST claim

Mutual Uniting System (MUS) — a first-deposit bonus is paid twice and never capped, so a fresh deposit-withdraw returns more ETH than it put in

Nimiq HTLC handlers — OpenGSN execute() ignores the signature and opens an HTLC as the liquidity wallet

Notional V1 escrow — unbacked fCash mint overflows uint128 ladders and settles as cash

OMNI404 (O404) — ERC-404 transfer(id≤50) + whitelist rounding drain

ORB addPoolAndSell — BNB refund before the sell, then burnLP grinds the pair and a last swap takes the WBNB

Order factory — permissionless createOrderForBuyer sets attacker as seller and aborts the buyer's ETH

Pancake V3 Swap Helper — Signed Swap Delta Misread as the WBNB Payout

PrimeFi verifyReport — permissionless stale Chainlink Data Streams report inflates PRFI and empties the WHYPE reserve

Reddio RedSonic Vault — permissionless registerErc20(stETH) double-counts one balance

rsETH Safe drain — Router multicall treats a self-call as authorized and the enabled module delegatecalls a recipe

Secured.Fi — same-block self-trade pins getMarketUnitPrice at par and drains WBTC

SKYDAO sell path — controlburn + sync() before the net credit desyncs the pair reserve