Hacks / Statistics / Q3 2021
Q3 2021 Exploit Report
July–September 2021: 13 reproduced exploits, $678M in stated losses.
13 exploits from July–September 2021 are reproduced in the library, the same number as in Q2 2021. 12 of them state a dollar loss, $678M in total, against $142M the quarter before. Logic was the most common root-cause category, on 5 of the 13 incidents (38%). Ethereum had both the most incidents (8) and the largest stated losses ($665M). The largest stated loss was Poly Network Exploit at $610M, 90% of the quarter's stated total.
Incidents
13
13 in Q2 2021.
Stated losses
$678M
12 of 13 incidents state a dollar figure. $142M in Q2 2021.
Largest stated loss
$610M
Poly Network Exploit
Most common root cause
Logic
On 5 of 13 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 5 | $23.8M |
| Access Control | 3 | $616M |
| Arithmetic | 2 | $74 |
| Oracle Manipulation | 2 | $1.1M |
| Reentrancy | 2 | $21.4M |
| Untagged | 2 | $16M |
| Bridge | 1 | $610M |
| Data Integrity | 1 | $4M |
| Dependency | 1 | $3M |
| Governance | 1 | $1.1M |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 8 | $665M |
| BNB Chain | 4 | $13.1M |
| Avalanche | 1 | $70K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Poly Network Exploit | Ethereum | $610M |
| Popsicle Finance (Sorbetto Fragola) Exploit | Ethereum | $20.7M |
| Cream Finance / AMP Exploit | Ethereum | $18.8M |
| ChainSwap Exploit | Ethereum | $8M |
| ChainSwap Exploit (BSC) | BNB Chain | $8M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Poly Network ExploitFunction-Selector Collision Hijacks the Cross-Chain Keeper Public Key | Aug 2021 | Ethereum | Access Control | $610M |
| Popsicle Finance (Sorbetto Fragola) ExploitLP-Token Transfer Skips Reward-Debt Sync | Aug 2021 | Ethereum | Logic | $20.7M |
| Cream Finance / AMP ExploitCross-Market Reentrancy via ERC777 tokensReceived | Aug 2021 | Ethereum | Reentrancy | $18.8M |
| ChainSwap ExploitSelf-Signed receive() Cross-Chain Mint (Forgeable Validator Set) | Jul 2021 | Ethereum | Untagged | $8M |
| ChainSwap Exploit (BSC)Self-Signed receive() Cross-Chain Mint (Forgeable Validator Set) | Jul 2021 | BNB Chain | Untagged | $8M |
| DAO Maker ExploitUnprotected init() Re-initialization → emergencyExit Vesting Drain | Sep 2021 | Ethereum | Access Control | $4M |
| MISO / SushiSwap Dutch Auctionbatch() delegatecall Reuses msg.value | Sep 2021 | Ethereum | Logic | $3M |
| XSURGE (Surge) ExploitReentrancy on a Liquidity-less Bonding-Curve Token | Aug 2021 | BNB Chain | Reentrancy | $2.6M |
| Levyathan Finance ExploitLeaked Deployer Key → Timelock-Gated Ownership Hijack → Unlimited mint() | Jul 2021 | BNB Chain | Access Control | $1.5M |
| Wault Finance ExploitWUSDMaster redeem() Pro-Rata WEX Drain via Self-Manipulated WEX Price | Aug 2021 | BNB Chain | Oracle Manipulation | $1.1M |
| ZABU Finance ExploitMasterChef Reward Inflation via Fee-on-Transfer lpSupply Collapse | Sep 2021 | Avalanche | Logic | $70K |
| Nimbus Pair ExploitBroken K-Invariant Check (10000 vs 1000 Scaling Bug) | Sep 2021 | Ethereum | Arithmetic | $74 |
| NowSwap / Nimbus ExploitBroken k-Invariant via a 10000 vs 1000 Scaling Mismatch | Sep 2021 | Ethereum | Arithmetic | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.