Hacks / Statistics / Q3 2022
Q3 2022 Exploit Report
July–September 2022: 31 reproduced exploits, $161M in stated losses.
31 exploits from July–September 2022 are reproduced in the library, 9 more than in Q2 2022. 26 of them state a dollar loss, $161M in total, against $397M the quarter before. Logic was the most common root-cause category, on 13 of the 31 incidents (42%). BNB Chain had the most incidents (17), while Ethereum carried the largest stated losses ($156M). The largest stated loss was Nomad Bridge Exploit at $152M, 95% of the quarter's stated total.
Incidents
31
22 in Q2 2022.
Stated losses
$161M
26 of 31 incidents state a dollar figure. $397M in Q2 2022.
Largest stated loss
$152M
Nomad Bridge Exploit
Most common root cause
Logic
On 13 of 31 incidents.
Root causes
How many of the quarter's incidents carry each category.
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 13 | $4.5M |
| Access Control | 12 | $4.9M |
| Oracle Manipulation | 7 | $921K |
| DeFi | 6 | $226K |
| Governance | 5 | $898K |
| Untagged | 3 | $228K |
| Reentrancy | 2 | $1.4M |
| Arithmetic | 1 | $45.7K |
| Authentication | 1 | $2.7K |
| Bridge | 1 | $152M |
| Data Integrity | 1 | $152M |
| Dependency | 1 | $1.4M |
| Input Validation | 1 | — |
Chains
Where the exploited contracts were deployed.
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 17 | $2.5M |
| Ethereum | 12 | $156M |
| Avalanche | 1 | $371K |
| Fantom | 1 | $1.7M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Nomad Bridge Exploit | Ethereum | $152M |
| Reaper Farm Exploit | Fantom | $1.7M |
| BADCODE MEV Bot Exploit | Ethereum | $1.4M |
| Omni Protocol Exploit | Ethereum | $1.4M |
| NewFreeDAO (NFD) Exploit | BNB Chain | $1.3M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Nomad Bridge ExploitFraudulent Zero-Root Makes Every Forged Message "Proven" | Aug 2022 | Ethereum | Bridge | $152M |
| Reaper Farm ExploitERC-4626 redeem() / withdraw() Missing Allowance Check | Aug 2022 | Fantom | Logic | $1.7M |
| BADCODE MEV Bot ExploitUnauthenticated dYdX callFunction Callback Drained to a Max Approval | Sep 2022 | Ethereum | Access Control | $1.4M |
| Omni Protocol ExploitNFT-Lending Re-Entrancy via withdrawERC721 / liquidationERC721 | Jul 2022 | Ethereum | Reentrancy | $1.4M |
| NewFreeDAO (NFD) ExploitStateless, Self-Resetting Reward Lets a Borrowed Balance Be Compounded 50× | Sep 2022 | BNB Chain | Logic | $1.3M |
| Audius Governance TakeoverRe-callable initialize() on Live Proxies via Storage-Slot Collision | Jul 2022 | Ethereum | Access Control | $1.1M |
| YYDS ExploitSpot-Price Oracle Manipulation via Flash-Swap Reserve Draining | Sep 2022 | BNB Chain | Oracle Manipulation | $398K |
| NXUSD / Nereus Protocol ExploitLP-Token Oracle Manipulation Drains a Cauldron Lending Market | Sep 2022 | Avalanche | Oracle Manipulation | $371K |
| ShadowFi (SDF) ExploitPermissionless burn() Drains the AMM Pair Reserve | Sep 2022 | BNB Chain | Access Control | $300K |
| Circle / MakerDAO PSM ExploitFree Vault Closure via a Pre-Authorized CDP | Aug 2022 | Ethereum | Untagged | $152K |
| BNB48 MEV Bot ExploitUnprotected pancakeCall Callback Drains the Bot's Inventory | Sep 2022 | BNB Chain | Access Control | $144K |
| DDC (BananaSwapToken) ExploitPermissionless handleDeductFee() Pool-Reserve Drain | Aug 2022 | BNB Chain | Access Control | $105K |
| RADT (RADT-DAO / "Dream plan" TWN) ExploitPermissionless Reward withdraw() Drains the LP Pair's Token Reserve | Sep 2022 | BNB Chain | Access Control | $89K |
| Zoompro Finance (ZOOM) ExploitManipulable FakeUSDT Reserve Skews the Zoom→USD Price | Sep 2022 | BNB Chain | Oracle Manipulation | $61K |
| MakerDAO UNIV2DAIUSDC CDP ExploitFree Collateral Withdrawal via a Mis-priced LP-Token Vault (frob) | Aug 2022 | Ethereum | Untagged | $50.5K |
| LPC Token ExploitSelf-Transfer Balance Overwrite Mints Free Tokens | Jul 2022 | BNB Chain | Logic | $45.7K |
| ROI Token ExploitMissing onlyOwner on transferOwnership → Reflection-Accounting Mint | Sep 2022 | BNB Chain | Access Control | $44K |
| XSTABLE.PROTOCOL (XST) Exploitskim()-driven elastic-supply mint that re-inflates the pool's own token reserve | Aug 2022 | Ethereum | Logic | $43K |
| EGD Finance ExploitFlash-Loan Spot-Price Oracle Manipulation Inflates Staking Rewards | Aug 2022 | BNB Chain | Oracle Manipulation | $36K |
| BXH ExploitSpot-Price Bonus Payout Manipulated via Flash-Loan | Sep 2022 | BNB Chain | Oracle Manipulation | $31.6K |
| XSTABLE.PROTOCOL (XST) Exploitskim()-Driven Rebase Mint Inflates Pool Reserves | Aug 2022 | Ethereum | Untagged | $26K |
| SpaceGodzilla ExploitPermissionless swapTokensForOther / swapAndLiquifyStepv1 Pool-Accounting Drain | Jul 2022 | BNB Chain | Access Control | $22.5K |
| ANCH Token ExploitReflection Reward Minted on Pair-to-Self skim() Transfers | Aug 2022 | BNB Chain | Logic | $10K |
| ETN / EtnProduct ExploitProtocol-Funded Liquidity Sent to the Caller (addLiquidity → msg.sender) | Aug 2022 | BNB Chain | Access Control | $3.1K |
| Quixotic (Optimism NFT Marketplace) ExploitUnsigned buyer Parameter Drains Any Approved ERC-20 Allowance | Jul 2022 | Ethereum | Authentication | $2.7K |
| Thunder Brawl (THB) ExploitclaimReward() Reentrancy via ERC-721 Mint Callback | Sep 2022 | BNB Chain | Reentrancy | $2K |
| Bad Guys by RPF ExploitUnbounded chosenAmount in WhiteListMint() (Per-Wallet Mint Limit Bypass) | Sep 2022 | Ethereum | Logic | not in dollars |
| DPC (DARK_POOL) ExploitclaimStakeLp Self-Compounds the LP Reward Quota (Geometric Doubling) | Sep 2022 | BNB Chain | Logic | not in dollars |
| FlippazOne ExploitMissing onlyOwner on the Fund-Withdrawal Functions | Jul 2022 | Ethereum | Access Control | not in dollars |
| LuckyTiger NFT ExploitPredictable On-Chain "Randomness" in a Pay-to-Win Mint | Aug 2022 | Ethereum | Logic | not in dollars |
| QIXI Token ExploitFlash-Swap Repaid With a Free-to-Mint / Fee-Skimming Token | Aug 2022 | BNB Chain | Oracle Manipulation | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.