Hacks / Statistics / Q2 2021
Q2 2021 Exploit Report
April–June 2021: 13 reproduced exploits, $142M in stated losses.
13 exploits from April–June 2021 are reproduced in the library, 9 more than in Q1 2021. 11 of them state a dollar loss, $142M in total, against $15.1M the quarter before. Governance was the most common root-cause category, on 7 of the 13 incidents (54%). BNB Chain had both the most incidents (10) and the largest stated losses ($131M). The largest stated loss was Uranium Finance Exploit at $50M, 35% of the quarter's stated total.
Incidents
13
4 in Q1 2021.
Stated losses
$142M
11 of 13 incidents state a dollar figure. $15.1M in Q1 2021.
Largest stated loss
$50M
Uranium Finance Exploit
Most common root cause
Governance
On 7 of 13 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Governance | 7 | $48.8M |
| Logic | 6 | $51.8M |
| Oracle Manipulation | 6 | $87.4M |
| DeFi | 3 | $80.7M |
| Arithmetic | 2 | $30.5M |
| Reentrancy | 2 | $14.2M |
| Access Control | 1 | — |
| Data Integrity | 1 | — |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 10 | $131M |
| Ethereum | 2 | $11M |
| Polygon | 1 | $188K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Uranium Finance Exploit | BNB Chain | $50M |
| PancakeBunny Exploit | BNB Chain | $45M |
| Spartan Protocol Exploit | BNB Chain | $30.5M |
| Rari Capital ETH Pool Exploit | Ethereum | $11M |
| BurgerSwap (Demax) Exploit | BNB Chain | $3.2M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Uranium Finance ExploitBroken Constant-Product K Check (100× Slack in swap()) | Apr 2021 | BNB Chain | Logic | $50M |
| PancakeBunny ExploitFlash-Loan LP Price-Oracle Manipulation Mints Unlimited BUNNY | May 2021 | BNB Chain | Oracle Manipulation | $45M |
| Spartan Protocol ExploitLP-Share Inflation via Spot-Balance Accounting + Unsynced Donation | May 2021 | BNB Chain | Oracle Manipulation | $30.5M |
| Rari Capital ETH Pool ExploitibETH.totalETH() Accounting Reentrancy via Bank.work() | May 2021 | Ethereum | Reentrancy | $11M |
| BurgerSwap (Demax) ExploitRe-entrant Multi-Hop Swap Drains the WBNB Side of the Pool Twice | May 2021 | BNB Chain | Reentrancy | $3.2M |
| PancakeHunny ExploitmintFor() Reward Inflation via balanceOf(this) Donation | Jun 2021 | BNB Chain | Logic | $700K |
| Eleven Finance ExploitemergencyBurn() Pays Out Underlying Without Burning Vault Shares | Jun 2021 | BNB Chain | Logic | $648K |
| SafeDollar (SDO) ExploitMasterChef Reward Inflation via Drained lpSupply Divisor | Jun 2021 | Polygon | Logic | $188K |
| xWin Finance ExploitDisabled Slippage Control + _tradeParams.amount-Based Reward Inflation | Jun 2021 | BNB Chain | DeFi | $176K |
| JulSwap (JulProtocolV2) ExploitSpot-Price Manipulation of addBNB() Liquidity Provisioning | May 2021 | BNB Chain | Oracle Manipulation | $155K |
| bEarn / bVaults BUSD-Alpaca Strategy ExploitemergencyWithdraw Re-prices Shares Against a Self-Inflating wantLockedTotal | May 2021 | BNB Chain | Logic | $123K |
| 88mph NFT ExploitUnprotected init() Lets Anyone Seize Ownership of a Live NFT Clone | Jun 2021 | Ethereum | Access Control | not in dollars |
| Value DeFi vSafe WBNB VaultInflated-Share Mint via Manipulated Alpaca ibBNB Strategy Price | May 2021 | BNB Chain | Oracle Manipulation | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.