Hacks / Statistics / Q1 2023
Q1 2023 Exploit Report
January–March 2023: 37 reproduced exploits, $324M in stated losses.
37 exploits from January–March 2023 are reproduced in the library, 23 fewer than in Q4 2022. 24 of them state a dollar loss, $324M in total, against $63M the quarter before. Logic was the most common root-cause category, on 26 of the 37 incidents (70%). BNB Chain had the most incidents (18), while Ethereum carried the largest stated losses ($205M). The largest stated loss was Euler Finance $197M Exploit at $197M, 61% of the quarter's stated total.
Incidents
37
60 in Q4 2022.
Stated losses
$324M
24 of 37 incidents state a dollar figure. $63M in Q4 2022.
Largest stated loss
$197M
Euler Finance $197M Exploit
Most common root cause
Logic
On 26 of 37 incidents.
Root causes
How many of the quarter's incidents carry each category.
Logic26DeFi10Access Control8Oracle Manipulation7Dependency4Reentrancy4Arithmetic3Untagged1
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 26 | $221M |
| DeFi | 10 | $294K |
| Access Control | 8 | $13.3M |
| Oracle Manipulation | 7 | $107M |
| Dependency | 4 | $2.6M |
| Reentrancy | 4 | $13.1M |
| Arithmetic | 3 | $3.9M |
| Untagged | 1 | — |
Chains
Where the exploited contracts were deployed.
BNB Chain18Ethereum13Polygon3Arbitrum2Avalanche1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 18 | $11.7M |
| Ethereum | 13 | $205M |
| Polygon | 3 | $95.6M |
| Arbitrum | 2 | $3.6M |
| Avalanche | 1 | $8.5M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Euler Finance $197M Exploit$197MBonqDAO / AllianceBlock Exploit$88MSafeMoon Exploit$8.9MPlatypus Finance Exploit$8.5MMidas Capital Exploit$6.6M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Euler Finance $197M Exploit | Ethereum | $197M |
| BonqDAO / AllianceBlock Exploit | Polygon | $88M |
| SafeMoon Exploit | BNB Chain | $8.9M |
| Platypus Finance Exploit | Avalanche | $8.5M |
| Midas Capital Exploit | Polygon | $6.6M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Euler Finance $197M ExploitdonateToReserves Enables Self-Liquidation That Drains the Protocol's Reserves | Mar 2023 | Ethereum | Logic | $197M |
| BonqDAO / AllianceBlock ExploitTellorFlex Oracle Price Manipulation (Cheap-Stake submitValue) | Feb 2023 | Polygon | Oracle Manipulation | $88M |
| SafeMoon ExploitUnprotected burn(from, amount) Drains the AMM Pair Reserve | Mar 2023 | BNB Chain | Access Control | $8.9M |
| Platypus Finance ExploitFlawed LP-Collateral Pricing in PlatypusTreasure (_getLPUnitPrice) | Feb 2023 | Avalanche | Oracle Manipulation | $8.5M |
| Midas Capital ExploitReentrancy-inflated Curve-LP Oracle for stMATIC Collateral (Compound v2 fork, Polygon) | Jan 2023 | Polygon | Reentrancy | $6.6M |
| dForce ExploitRead-only Reentrancy via Curve remove_liquidity into the dForce Price Oracle | Feb 2023 | Arbitrum | Reentrancy | $3.6M |
| EFVault / ENF Exploitredeem() Share-Price Decimal Bug Drains USDC | Feb 2023 | Ethereum | Arithmetic | $3.4M |
| Orion Protocol ExploitReentrancy via Malicious Deposit Token in swapThroughOrionPool / depositAsset | Feb 2023 | Ethereum | Reentrancy | $2.8M |
| Dexible ExploitCaller-Controlled router/routerData in selfSwap/fill | Feb 2023 | Ethereum | Dependency | $1.5M |
| Phoenix (PHX) ExploitMissing Access Control on delegateCallSwap(bytes) | Mar 2023 | Polygon | Access Control | $1M |
| SwapX ExploitUnverified swapX Router Drains Pre-Approved Victim BUSD via Caller-Controlled Recipient | Feb 2023 | BNB Chain | Access Control | $1M |
| LaunchZone (LZ) ExploitUnverified swapXImp Logic Flaw (Permissionless Victim-Side Swap) | Feb 2023 | BNB Chain | Access Control | $700K |
| Poolz LockedDeal ExploitInteger Overflow in getArraySum Crediting Free Vesting Pools | Mar 2023 | BNB Chain | Arithmetic | $390K |
| BRA Token Exploit_transfer Buy/Sell Tax Credited to the Pair Itself, Drained via skim() | Jan 2023 | BNB Chain | Logic | $224K |
| GDS Coin ExploitSpot-Price pureUsdtToToken Reward Inflation via Nested Flash Loans (BSC) | Jan 2023 | BNB Chain | Oracle Manipulation | $207K |
| CowSwap SwapGuard ExploitUnvalidated Interaction Target in envelope() (arbitrary transferFrom under maxint allowedLoss) | Feb 2023 | Ethereum | Access Control | $115K |
| UFO/UFDao (UFT) ExploitTreasury-Share Mispricing on a Tiny-Supply LP Token | Jan 2023 | BNB Chain | Logic | $90.1K |
| DKP Exchange ExploitFlash-Loan-Manipulated AMM Price Oracle Lets 100 USDT Buy the Whole DKP Reserve | Mar 2023 | BNB Chain | Oracle Manipulation | $80.5K |
| ROE Finance ExploitManipulatable LP-Token Oracle + Re-deposit Collateral Inflation | Jan 2023 | Ethereum | Oracle Manipulation | $64.1K |
| BEVO ExploitReflective-Token deliver() Pool-Balance Inflation Drain (PancakeSwap Flash) | Jan 2023 | BNB Chain | Logic | $40K |
| BIGFI ExploitReflection-Token burn() That Shrinks Supply Without Shrinking Reflection Space | Mar 2023 | BNB Chain | DeFi | $30.3K |
| DBW Finance ExploitDividend Reward Double-Claimed via 18 Proxy Clones Each Holding ~100% of the LP | Mar 2023 | BNB Chain | Logic | $21.7K |
| Revert Finance (V3Utils) ExploitUnvalidated swapData Lets Anyone Route User-Allowance Tokens to an Attacker | Feb 2023 | Ethereum | Dependency | $19.8K |
| Thena RewardPool ExploitReentrant unstake(…, claim=true) Double-Payout of Converted Rewards | Mar 2023 | BNB Chain | Reentrancy | $10.2K |
| DYNA (Dynamic) ExploitReward-Inflation in StakingDYNA.deposit/redeem + Time-Bypassable Sell Cap | Feb 2023 | BNB Chain | Logic | not in dollars |
| FDP (FireDrake) ExploitReflective-Token deliver() Inflates the AMM Pair's Balance | Feb 2023 | BNB Chain | DeFi | not in dollars |
| OmniEstate ExploitStaking Reward Calculated From a Stale Storage Variable (Zero-Duration Over-Claim) | Jan 2023 | BNB Chain | Logic | not in dollars |
| ParaSpace ExploitApeCoin-Staking (cAPE) Collateral Mis-Accounting + Same-Tx Supply→Borrow | Mar 2023 | Ethereum | Logic | not in dollars |
| ParaSpace Exploit (variant 2)ApeCoin Staking Supply/Borrow Reentrancy | Mar 2023 | Ethereum | Untagged | not in dollars |
| QTN (QUATERNION) ExploitReflection-Supply Rebase Inflation via skim() Loop | Jan 2023 | Ethereum | DeFi | not in dollars |
| Sheep ExploitReflective-Token _burn Distorts balanceOf, Drains SHEEP/WBNB Pair via DODO Flash | Feb 2023 | BNB Chain | DeFi | not in dollars |
| SHOCO ExploitReflection deliver() Deflation Inflates the AMM Pair's Effective Balance | Jan 2023 | Ethereum | DeFi | not in dollars |
| Sperax USDs ExploitisContract()-Based Rebase Accounting Flip on a Pre-Credited EOA | Feb 2023 | Arbitrum | Logic | not in dollars |
| Starlink (Starlink Coin) ExploitReflective Token Fee vs. Pancake skim/sync Reserve Drain | Feb 2023 | BNB Chain | DeFi | not in dollars |
| Thoreum Finance ExploitDividend/Rebase Token Self-Transfer Balance Inflation | Jan 2023 | BNB Chain | Logic | not in dollars |
| TomInu (TINU) ExploitReflective-Token (RFI) Reflection-Rate Skim against a Uniswap-V2 Pair | Jan 2023 | Ethereum | DeFi | not in dollars |
| Upswing (UPS) ExploitsellPressure Farming + releasePressure() LP-Burn That Breaks k | Jan 2023 | Ethereum | DeFi | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.