Hacks / Statistics / Q1 2022
Q1 2022 Exploit Report
January–March 2022: 20 reproduced exploits, $769M in stated losses.
20 exploits from January–March 2022 are reproduced in the library, 13 more than in Q4 2021. 15 of them state a dollar loss, $769M in total, against $215M the quarter before. Logic was the most common root-cause category, on 9 of the 20 incidents (45%). Ethereum had both the most incidents (13) and the largest stated losses ($764M). The largest stated loss was Ronin Bridge Exploit at $625M, 81% of the quarter's stated total.
Incidents
20
7 in Q4 2021.
Stated losses
$769M
15 of 20 incidents state a dollar figure. $215M in Q4 2021.
Largest stated loss
$625M
Ronin Bridge Exploit
Most common root cause
Logic
On 9 of 20 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 9 | $57.5M |
| Reentrancy | 6 | $7.7M |
| Access Control | 5 | $746M |
| Dependency | 3 | $14.4M |
| Arithmetic | 2 | $700K |
| Bridge | 2 | $705M |
| Authentication | 1 | $1M |
| Governance | 1 | $110K |
| Input Validation | 1 | — |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 13 | $764M |
| Fantom | 2 | $1.4M |
| Gnosis | 2 | $1.5M |
| Arbitrum | 1 | — |
| BNB Chain | 1 | $1.7M |
| Moonbeam | 1 | $1M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Ronin Bridge Exploit | Ethereum | $625M |
| Qubit Finance QBridge Exploit | Ethereum | $80M |
| Compound cTUSD sweepToken Exploit | Ethereum | $40M |
| Anyswap (Multichain V4 Router) Exploit | Ethereum | $8M |
| LiFi Exploit | Ethereum | $5.7M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Ronin Bridge ExploitSky Mavis Validator Key Compromise (Forged Withdrawals) | Mar 2022 | Ethereum | Access Control | $625M |
| Qubit Finance QBridge ExploitZero-Address Token Whitelist Bypass | Jan 2022 | Ethereum | Bridge | $80M |
| Compound cTUSD sweepToken ExploitComptroller Swap to Compliant TrueUSD | Mar 2022 | Ethereum | Access Control | $40M |
| Anyswap (Multichain V4 Router) ExploitUnderlying-Transfer Cross-Chain Drain | Jan 2022 | Ethereum | Dependency | $8M |
| LiFi ExploitUnvalidated callTo/approveTo in the Pre-Bridge Swap Facet | Mar 2022 | Ethereum | Dependency | $5.7M |
| Revest Finance ExploitReentrancy in FNFT mintAddressLock/withdraw | Mar 2022 | Ethereum | Reentrancy | $2M |
| Paraluni MasterChef ExploitReentrancy in depositByAddLiquidity via Malicious Token | Mar 2022 | BNB Chain | Reentrancy | $1.7M |
| Agave Finance ExploitReentrancy in liquidationCall (Aave-v2 fork) | Mar 2022 | Gnosis | Reentrancy | $1.5M |
| OneRing Finance ExploitMissing Reentrancy Guard + Under-priced depositSafe | Mar 2022 | Fantom | Reentrancy | $1.4M |
| Bacon Protocol ExploitReentrancy via ERC-1820 tokensReceived in lend/redeem | Mar 2022 | Ethereum | Reentrancy | $1M |
| Meter.io ExploitAnyswapV3ERC20 transferWithPermit Guard Logic Flaw | Feb 2022 | Moonbeam | Logic | $1M |
| Umbrella Network RewardPool ExploitInteger Underflow in withdraw | Mar 2022 | Ethereum | Arithmetic | $700K |
| Auctus (ACO) ExploitACOWriter Trusts Attacker-Supplied acoToken + Arbitrary exchange Call | Mar 2022 | Ethereum | Logic | $682K |
| TecraSpace (TCR) ExploitSwapped Allowance Keys in burnFrom | Feb 2022 | Ethereum | Logic | $639K |
| Build Finance (BUILD) ExploitGovernance Takeover via Low Quorum → Arbitrary-Proposal Drain | Feb 2022 | Ethereum | Governance | $110K |
| Fantasm Finance ExploitDecimal Miscalculation in mint Over-issues xFTM | Mar 2022 | Fantom | Arithmetic | not in dollars |
| Hundred Finance ExploitERC-667 Reentrancy in borrow/redeem (Compound fork) | Mar 2022 | Gnosis | Reentrancy | not in dollars |
| Redacted Cartel (wxBTRFLY) ExploitFaulty transferFrom Allowance Logic | Mar 2022 | Ethereum | Logic | not in dollars |
| The Sandbox LAND ExploitPublic _burn of Anyone's NFT | Feb 2022 | Ethereum | Access Control | not in dollars |
| TreasureDAO Marketplace ExploitZero-Quantity Buy Drains Listed NFTs for Free (_pricePerItem * _quantity with _quantity = 0) | Mar 2022 | Arbitrum | Logic | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.