Hacks / Statistics / Q4 2021
Q4 2021 Exploit Report
October–December 2021: 7 reproduced exploits, $215M in stated losses.
7 exploits from October–December 2021 are reproduced in the library, 6 fewer than in Q3 2021. 7 of them state a dollar loss, $215M in total, against $678M the quarter before. Oracle Manipulation was the most common root-cause category, on 5 of the 7 incidents (71%). Ethereum had both the most incidents (4) and the largest stated losses ($205M). The largest stated loss was Cream Finance (Oct 2021) Exploit at $130M, 61% of the quarter's stated total.
Incidents
7
13 in Q3 2021.
Stated losses
$215M
7 of 7 incidents state a dollar figure. $678M in Q3 2021.
Largest stated loss
$130M
Cream Finance (Oct 2021) Exploit
Most common root cause
Oracle Manipulation
On 5 of 7 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Oracle Manipulation | 5 | $205M |
| Logic | 4 | $83.2M |
| Dependency | 2 | $9.5M |
| Arithmetic | 1 | $130M |
| Governance | 1 | $365K |
| Reentrancy | 1 | $1.3M |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 4 | $205M |
| BNB Chain | 2 | $8.4M |
| Fantom | 1 | $1.3M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Cream Finance (Oct 2021) Exploit | Ethereum | $130M |
| Indexed Finance Exploit | Ethereum | $36M |
| MonoX Finance Exploit | Ethereum | $31M |
| Visor Finance (vVISR) Exploit | Ethereum | $8.2M |
| Nerve Bridge (Saddle/MetaSwap) Exploit | BNB Chain | $8M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Cream Finance (Oct 2021) ExploityUSD pricePerShare Donation-Inflation → Over-Collateralized Borrow | Oct 2021 | Ethereum | Oracle Manipulation | $130M |
| Indexed Finance ExploitreindexPool + updateMinimumBalance Index-Token Mint/Redeem Manipulation | Oct 2021 | Ethereum | Oracle Manipulation | $36M |
| MonoX Finance ExploitSelf-Swap Price Inflation (swapExactTokenForToken(MONO, MONO)) | Nov 2021 | Ethereum | Oracle Manipulation | $31M |
| Visor Finance (vVISR) ExploitFree Share Minting via Attacker-Controlled delegatedTransferERC20 | Dec 2021 | Ethereum | Dependency | $8.2M |
| Nerve Bridge (Saddle/MetaSwap) ExploitStale baseVirtualPrice Cache Lets a Round-Trip Mint Free fUSD | Dec 2021 | BNB Chain | Oracle Manipulation | $8M |
| Grim Finance ExploitReentrant depositFor() Share Inflation in the GrimBoost Vault | Dec 2021 | Fantom | Reentrancy | $1.3M |
| Ploutoz / Dollar Online (DOP) ExploitSpot-Price Oracle Manipulation Against a bZx/Fulcrum-Fork Lending Pool | Nov 2021 | BNB Chain | Oracle Manipulation | $365K |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.