Hacks / Statistics / Q4 2022
Q4 2022 Exploit Report
October–December 2022: 60 reproduced exploits, $63M in stated losses.
60 exploits from October–December 2022 are reproduced in the library, 29 more than in Q3 2022. 54 of them state a dollar loss, $63M in total, against $161M the quarter before. Access Control was the most common root-cause category, on 31 of the 60 incidents (52%). BNB Chain had the most incidents (35), while Ethereum carried the largest stated losses ($28.3M). The largest stated loss was Transit Finance Exploit at $21M, 33% of the quarter's stated total.
Incidents
60
31 in Q3 2022.
Stated losses
$63M
54 of 60 incidents state a dollar figure. $161M in Q3 2022.
Largest stated loss
$21M
Transit Finance Exploit
Most common root cause
Access Control
On 31 of 60 incidents.
Root causes
How many of the quarter's incidents carry each category.
Access Control31Logic25Oracle Manipulation19Dependency10Arithmetic7DeFi7Reentrancy7Governance6Untagged2Authentication1
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Access Control | 31 | $43.6M |
| Logic | 25 | $44.5M |
| Oracle Manipulation | 19 | $10.3M |
| Dependency | 10 | $5.1M |
| Arithmetic | 7 | $10.7M |
| DeFi | 7 | $482K |
| Reentrancy | 7 | $5M |
| Governance | 6 | $1.8M |
| Untagged | 2 | $541K |
| Authentication | 1 | — |
| Input Validation | 1 | $3.6K |
Chains
Where the exploited contracts were deployed.
BNB Chain35Ethereum18Avalanche4Polygon2Arbitrum1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 35 | $25.4M |
| Ethereum | 18 | $28.3M |
| Avalanche | 4 | $2.7M |
| Polygon | 2 | $181K |
| Arbitrum | 1 | $6.5M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Transit Finance Exploit$21MTeam Finance Exploit$15.8MLodestar Finance Exploit$6.5MDFX Finance Exploit$4MMultichain (Anyswap) anySwapOutUnderlyingWithPermit$3M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Transit Finance Exploit | BNB Chain | $21M |
| Team Finance Exploit | Ethereum | $15.8M |
| Lodestar Finance Exploit | Arbitrum | $6.5M |
| DFX Finance Exploit | Ethereum | $4M |
| Multichain (Anyswap) anySwapOutUnderlyingWithPermit | Ethereum | $3M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Transit Finance ExploitArbitrary transferFrom via Unvalidated Swap Owner | Oct 2022 | BNB Chain | Logic | $21M |
| Team Finance Exploitmigrate() Burns Other People's Locked LP via an Unvalidated pair Parameter | Oct 2022 | Ethereum | Logic | $15.8M |
| Lodestar Finance ExploitplvGLP Oracle Inflation Drains the Lending Pools | Dec 2022 | Arbitrum | Oracle Manipulation | $6.5M |
| DFX Finance ExploitReentrancy via Unguarded flash() Inflates LP Share Mint | Nov 2022 | Ethereum | Reentrancy | $4M |
| Multichain (Anyswap) anySwapOutUnderlyingWithPermitMissing-permit Allowance Theft | Nov 2022 | Ethereum | Dependency | $3M |
| TempleDAO StaxLPStaking ExploitAccess-Control-Free migrateStake() Pool Drain | Oct 2022 | Ethereum | Access Control | $2.3M |
| UEarnPool ExploitSelf-Referral claimTeamReward() Inflation Drain | Nov 2022 | BNB Chain | Logic | $2.2M |
| Overnight Finance USD+ ExploitNAV Inflation via Synapse Stable-Pool Manipulation | Dec 2022 | Avalanche | Oracle Manipulation | $1.6M |
| Rubic Exchange ExploitArbitrary External Call Drains User Allowances | Dec 2022 | Ethereum | Dependency | $1.5M |
| ElasticSwap ExploitInternal-Reserve Manipulation Drains the TIC/USDC.e AMM | Dec 2022 | Avalanche | Oracle Manipulation | $850K |
| EFLeverVault ExploitDirect flashLoan(0x2) Inflate-Balance Drain | Oct 2022 | Ethereum | Access Control | $640K |
| Nimbus Platform ExploitFlash-Loan AMM Spot-Price Manipulation of Staking Rewards | Dec 2022 | BNB Chain | Oracle Manipulation | $370K |
| OlympusDAO BondFixedExpiryTeller ExploitUnverified Bond-Token in redeem() Drains the Teller | Oct 2022 | Ethereum | Access Control | $292K |
| RES Token ExploitPermissionless thisAToB() Pool-Reserve Burn Breaks x·y = k | Oct 2022 | BNB Chain | Untagged | $291K |
| RES Token ExploitSelf-Burn-From-Pool + sync() Breaks the AMM Invariant | Oct 2022 | BNB Chain | DeFi | $291K |
| ULME Token ExploitPermissionless buyMiner() Spends Anyone's Pre-Approved USDT | Oct 2022 | BNB Chain | Access Control | $251K |
| ULME Token ExploitPermissionless buyMiner() Spends Victims' USDT Allowances | Oct 2022 | BNB Chain | Untagged | $251K |
| 0x0000…a47b1 MEV Bot ExploitUnauthenticated receiveFlashLoan Drains Idle WETH | Oct 2022 | Ethereum | Access Control | $245K |
| Rabby Wallet SwapRouter ExploitArbitrary External Call Drains Pre-Approved User Funds | Oct 2022 | Ethereum | Dependency | $200K |
| Market.xyz / Hundred-clone ExploitCurve LP Read-Only Reentrancy Inflates Collateral Price | Oct 2022 | Polygon | Reentrancy | $180K |
| Defrost Finance lendingSwitchErc20 ExploitReentrant Flash-Loan Share Inflation | Dec 2022 | Avalanche | Reentrancy | $174K |
| Beefy "Moo CAKE CTX" Vault ExploitHarvest-Sandwich Reward Theft | Nov 2022 | BNB Chain | Access Control | $142K |
| ATK ("Journey of Awakening") ExploitSpot-Price getPrice() Manipulation via Flash-Loaned Reserve Drain | Oct 2022 | BNB Chain | Oracle Manipulation | $127K |
| Abracadabra / Kashi Cauldron ExploitSelf-Liquidation Against a Stale Exchange Rate | Nov 2022 | Ethereum | Oracle Manipulation | $99K |
| MEV Bot 0x0AD8…afd4Arbitrary-Call Router Drains a Victim's Standing USDC Approval | Nov 2022 | Ethereum | Access Control | $91.6K |
| SheepFarm ExploitFree-Gem Mint via Repeatable register() | Nov 2022 | BNB Chain | Logic | $80K |
| Brahma Finance (BrahTOPG) Zapper ExploitArbitrary call Drains User Approvals | Nov 2022 | Ethereum | Dependency | $79.7K |
| AES (AEST) ExploitFee-Accumulator distributeFee() Drains the AMM Pair | Dec 2022 | BNB Chain | Oracle Manipulation | $61.6K |
| VTF (Victor the Fortune) ExploitCompounding Time-Based Mint via Self-Service updateUserBalance() | Oct 2022 | BNB Chain | Logic | $58.4K |
| MUBank ExploitFlash-Swap Manipulation of Reserve-Dependent Bond Pricing | Dec 2022 | Avalanche | Oracle Manipulation | $48.7K |
| Carrot Token ExploitArbitrary transReward() Hijacks the Reward Pool to Bypass transferFrom Allowance | Oct 2022 | BNB Chain | Access Control | $31.3K |
| FPR Token ExploitPublic setAdmin() Hijack Drains FPR Distributor Contracts + LP | Dec 2022 | BNB Chain | Access Control | $28.1K |
| n00d (SushiBar fork) ExploitERC777 Reentrancy via Stale totalSushi Share Inflation | Oct 2022 | Ethereum | Reentrancy | $26K |
| PLTD Exploit_bron Sell-Accumulator Burns From the Pool, Breaking x·y = k | Oct 2022 | BNB Chain | DeFi | $24.5K |
| BabySwap SwapMining ExploitRouter-Reported Swap Volume Forged via a Fake Factory | Oct 2022 | BNB Chain | Oracle Manipulation | $24.2K |
| TiFi Finance ExploitSpot-Price Oracle Manipulation of a Lending Pool | Dec 2022 | BNB Chain | Oracle Manipulation | $24K |
| INUKO / SIG Bond ExploitFlash-Loan LP Mispricing via balanceOf-based Valuation | Oct 2022 | BNB Chain | Oracle Manipulation | $18.4K |
| BGLD (BlackGold) ExploitMigration-Contract Inflation + AMM Reserve Manipulation | Dec 2022 | BNB Chain | Arithmetic | $18.1K |
| Aurum Finance (AUR) ExploitUnprotected changeRewardPerNode() Drains the Node-Reward Pool | Nov 2022 | BNB Chain | Access Control | $13.4K |
| sDAO ExploitStaking-Reward Accounting Manipulation via Self-Inflated totalStakeReward + Shrunken Reward Divisor | Nov 2022 | BNB Chain | Logic | $13.2K |
| BBOX Token ExploitFee-Engine Burns Tokens Out of the LP Pair and sync()s | Dec 2022 | BNB Chain | Logic | $10.8K |
| RL (RealLand) ExploitLP-Incentive Airdrop Drained via Reusable LP Position | Oct 2022 | BNB Chain | Logic | $9.1K |
| SEAMAN ExploitForced Tax-Swap Routed Through a Thin GVC Pool (Price Manipulation) | Nov 2022 | BNB Chain | Oracle Manipulation | $7.8K |
| APC (ArenaPlay) ExploitSpot-AMM-Price Swap Drained via Flash-Loan Pump & Dump | Dec 2022 | BNB Chain | Oracle Manipulation | $7.6K |
| MBC / ZZSH ExploitPublic swapAndLiquifyStepv1() Lets an Attacker Inject the Token's Own Accumulated Fees Into the Pool Reserve | Nov 2022 | BNB Chain | Access Control | $5.9K |
| BDEX (Bvaults) ExploitPermissionless convertDustToEarned() Sandwiched into a No-Slippage Pool Swap | Nov 2022 | BNB Chain | DeFi | $4.6K |
| HEALTH Token ExploitPermissionless Per-Transfer Pool-Reserve Burn | Oct 2022 | BNB Chain | DeFi | $3.7K |
| RFB (Roast Football) ExploitBrute-Forceable On-Chain "Lucky Buyer" Jackpot Drain | Dec 2022 | BNB Chain | Logic | $3.6K |
| MEV Bot 0x28d9 ExploitFlash-Loan Callback Hijack via Attacker-Controlled assetTo | Dec 2022 | Ethereum | Logic | $2.7K |
| UERII Token ExploitPublic, Unauthenticated mint() Inflates Supply and Drains the Liquidity Pool | Oct 2022 | Ethereum | Access Control | $2.5K |
| DFS Exploit_transfer Accounting Gap Let skim() Self-Loop Mint DFS Out of Thin Air | Dec 2022 | BNB Chain | Logic | $1.4K |
| Polynomial Protocol ExploitArbitrary swapTarget.call Drains Pre-Approved User Funds | Nov 2022 | Ethereum | Dependency | $1.4K |
| SheepFarm ExploitFree Gems via Repeatable register() | Nov 2022 | BNB Chain | Logic | $880 |
| Multicall multicallWithoutCheck()Unauthenticated Arbitrary-Call Drain | Oct 2022 | Polygon | Access Control | $620 |
| Annex Finance Liquidator ExploitUnauthenticated Flash-Swap Callback Drains the Contract | Nov 2022 | BNB Chain | Access Control | not in dollars |
| BEGO (BGeoToken) ExploitSignature-Gated mint() Bypassed With Empty Signature Arrays | Oct 2022 | BNB Chain | Authentication | not in dollars |
| HPAY (Hedge Pay) ExploitUnprotected setToken() Lets Anyone Restake Junk and Withdraw Real HPAY | Oct 2022 | BNB Chain | Access Control | not in dollars |
| JAY Token ExploitReentrancy via Attacker-Controlled "ERC721" Callback in buyJay | Dec 2022 | Ethereum | Reentrancy | not in dollars |
| Nova Exchange ExploitOwner-Only Unlimited Mint via rewardHolders() | Dec 2022 | BNB Chain | Access Control | not in dollars |
| Xave Finance ExploitSafeSnap / Reality DaoModule Permissionless Governance Takeover | Oct 2022 | Ethereum | Access Control | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.