Hacks / Statistics / Q2 2023
Q2 2023 Exploit Report
April–June 2023: 60 reproduced exploits, $74.1M in stated losses.
60 exploits from April–June 2023 are reproduced in the library, 23 more than in Q1 2023. 55 of them state a dollar loss, $74.1M in total, against $324M the quarter before. Logic was the most common root-cause category, on 42 of the 60 incidents (70%). BNB Chain had the most incidents (36), while Ethereum carried the largest stated losses ($43.9M). The largest stated loss was Compounder Finance Exploit at $27.2M, 37% of the quarter's stated total.
Incidents
60
37 in Q1 2023.
Stated losses
$74.1M
55 of 60 incidents state a dollar figure. $324M in Q1 2023.
Largest stated loss
$27.2M
Compounder Finance Exploit
Most common root cause
Logic
On 42 of 60 incidents.
Root causes
How many of the quarter's incidents carry each category.
Logic42Oracle Manipulation28Access Control20DeFi14Governance8Reentrancy6Arithmetic4Dependency4Data Integrity2Untagged2
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 42 | $34.7M |
| Oracle Manipulation | 28 | $52.3M |
| Access Control | 20 | $7.3M |
| DeFi | 14 | $1.8M |
| Governance | 8 | $41.8M |
| Reentrancy | 6 | $37.2M |
| Arithmetic | 4 | $8.1M |
| Dependency | 4 | $10.8M |
| Data Integrity | 2 | $266K |
| Untagged | 2 | $833K |
| Input Validation | 1 | $1M |
Chains
Where the exploited contracts were deployed.
BNB Chain36Ethereum15Arbitrum5Polygon3Base1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 36 | $12.9M |
| Ethereum | 15 | $43.9M |
| Arbitrum | 5 | $7.8M |
| Polygon | 3 | $2.1M |
| Base | 1 | $7.4M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Compounder Finance Exploit$27.2MYearn / iEarn yToken Exploit$11.5MBabyDoge FarmZAP Exploit$7.5MHundred Finance #2 Exploit$7.4MDEI Stablecoin Exploit$5M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Compounder Finance Exploit | Ethereum | $27.2M |
| Yearn / iEarn yToken Exploit | Ethereum | $11.5M |
| BabyDoge FarmZAP Exploit | BNB Chain | $7.5M |
| Hundred Finance #2 Exploit | Base | $7.4M |
| DEI Stablecoin Exploit | Arbitrum | $5M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Compounder Finance ExploitInflatable Share Price via Curve get_virtual_price() Manipulation | Jun 2023 | Ethereum | Oracle Manipulation | $27.2M |
| Yearn / iEarn yToken ExploitAPR-Oracle Routing + bZx Donation Inflates Price-Per-Share for ~$11.5M | Apr 2023 | Ethereum | Oracle Manipulation | $11.5M |
| BabyDoge FarmZAP ExploitUntrusted farm Callback Lets Anyone Drain Swapped Tokens | May 2023 | BNB Chain | Dependency | $7.5M |
| Hundred Finance #2 ExploitEmpty-Market Exchange-Rate Inflation Drains Every Pool | Apr 2023 | Base | Oracle Manipulation | $7.4M |
| DEI Stablecoin ExploitburnFrom() Grants the Caller Infinite Allowance, Draining the DEI/USDC Pair | May 2023 | Arbitrum | Access Control | $5M |
| Sushi RouteProcessor2 ExploitAttacker-Controlled "Pool" Drains Approved Tokens via uniswapV3SwapCallback | Apr 2023 | Ethereum | Logic | $3.3M |
| 0VIX Protocol ExploitvGHST Oracle Manipulation via Balance Donation | Apr 2023 | Polygon | Oracle Manipulation | $2M |
| Level Finance ExploitDuplicate-Epoch claimMultiple() Reward Multiplication | May 2023 | BNB Chain | Logic | $1M |
| Sentiment Protocol ExploitBalancer Read-Only Reentrancy Inflates LP-Collateral Price | Apr 2023 | Arbitrum | Reentrancy | $1M |
| Pawnfi ApeStaking ExploitUnrestricted collectRate + Vault-Funded Staking Drains the P-BAYC ApeCoin Reserve | Jun 2023 | Ethereum | Access Control | $820K |
| Sturdy Finance ExploitBalancer Read-Only Reentrancy Inflates LP-Token Collateral Price | Jun 2023 | Ethereum | Reentrancy | $800K |
| Paribus Finance ExploitCompound V2 Fork redeemFresh Cross-Market Reentrancy | Apr 2023 | Arbitrum | Reentrancy | $790K |
| CS Token ExploitStale Global sellAmount Drives an Attacker-Triggerable Pool Burn | May 2023 | BNB Chain | Logic | $684K |
| Jimbo Protocol ExploitTraderJoe LB Rebalance Manipulation & Floor-Price Decoupling | May 2023 | Arbitrum | Oracle Manipulation | $639K |
| Midas Capital ExploitcToken Exchange-Rate Inflation via Donation Into a Near-Empty Market | Jun 2023 | BNB Chain | Arithmetic | $600K |
| Allbridge Core ExploitStableSwap withdraw() Symmetric-Burn Drain via Flash-Loan-Induced Imbalance | Apr 2023 | BNB Chain | Untagged | $550K |
| Allbridge ExploitStableSwap LP Mispricing via Self-Imbalanced Pools | Apr 2023 | BNB Chain | Logic | $550K |
| Themis Protocol ExploitManipulable Balancer-LP (BPT) Price Oracle Enables Over-Borrowing | Jun 2023 | Arbitrum | Oracle Manipulation | $370K |
| DDCoin (DD) Marketplace ExploitSelf-Granted Allowance Lets the Seller Drain the Escrow Twice | Jun 2023 | BNB Chain | Logic | $300K |
| SHIDO Migration ExploitclaimTokens() Blind × 10⁹ Decimal Scaling Drains the Reward Wallet | Jun 2023 | BNB Chain | Untagged | $283K |
| SHIDO ExploitShidoLock Migration Mint With No Eligibility Check | Jun 2023 | BNB Chain | Logic | $230K |
| Goldseed landNFT ExploitUnprotected Minter Forwarder Lets Anyone Free-Mint 200 Land NFTs | May 2023 | BNB Chain | Access Control | $150K |
| ARA ExploitPermissionless "Swap-on-Behalf" Helper Drains a Pre-Approved Address via Pool Price Manipulation | Jun 2023 | BNB Chain | Access Control | $125K |
| LocalTraders (LCT) ExploitUnprotected Price-Oracle Initializer Drains the LCT/WBNB Pool | May 2023 | BNB Chain | Access Control | $120K |
| ERC20TokenBank / ExchangeBetweenPools ExploitZero-Slippage Curve Swap Sandwich | May 2023 | Ethereum | DeFi | $112K |
| LocalTrader2 (LCT) ExploitUnprotected Proxy Implementation Lets Anyone Set the Token Price to 1 wei | May 2023 | BNB Chain | Access Control | $110K |
| Vortex DEPUSDT / LEVUSDC ExploitPublic approveToken() → Arbitrary Reserve Drain | Jun 2023 | Ethereum | Access Control | $106K |
| BabyDogeCoin ExploitSandwiching the Token's Slippage-Free swapAndLiquify | Jun 2023 | BNB Chain | DeFi | $100K |
| SELLC / StakingRewards ExploitPermissionless sell() Drains Staked LP Tokens via a Self-Created Price Oracle | May 2023 | BNB Chain | Access Control | $95K |
| Melo (MEL) ExploitUnprotected mint() → Infinite-Supply Pool Drain | May 2023 | BNB Chain | Access Control | $90.5K |
| Cellframe Network ExploitManipulated Reserve Ratio in LpMigration.migrate() | Jun 2023 | BNB Chain | Oracle Manipulation | $76K |
| NeverFall (NF) Exploitsell() Over-Redeems LP Against a Pre-Crashed Pool Reserve | May 2023 | BNB Chain | Oracle Manipulation | $74.3K |
| Biswap V3Migrator ExploitArbitrary recipient LP Theft via Unauthorized migrate() | Jun 2023 | BNB Chain | Access Control | $72K |
| LW Token ExploitSpot-Price Oracle Manipulation Drains Protocol "Buyback" Treasury into the LP, Then Drains the LP | May 2023 | BNB Chain | Oracle Manipulation | $50K |
| LFI / VLFI ExploitclaimRewards() Reward-Debt Reset via Botched cleanUserMapping Migration | May 2023 | Polygon | Logic | $36K |
| Bitpaidio (BTP) Staking ExploitStale-Lock Reinvest Bug Enables Instant Flash-Loaned Staking ROI | May 2023 | BNB Chain | Logic | $30K |
| SellToken miner ExploitSpot-Price Reward Oracle Drained via Flash-Loaned Liquidity | Jun 2023 | BNB Chain | Oracle Manipulation | $30K |
| NST Swap ExploitDangling approve() lets the buyer drain the swap contract's USDT reserves | Jun 2023 | Polygon | Logic | $29.2K |
| MetaPoint (POT) ExploitPermissionless approve() on User-Wallet Contracts Drains Holder Balances | Apr 2023 | BNB Chain | Access Control | $24K |
| Contract 0x7657… ExploitPermissionless transferFrom-Drain of Standing Approvals | Jun 2023 | Ethereum | Access Control | $20K |
| GPT Token ExploitDeflationary transfer-Hook + skim() Pool Drain | May 2023 | BNB Chain | DeFi | $20K |
| Multi-Chain Capital ($MCC) ExploitReflection-Rate Inflation via deliver() + skim() | May 2023 | Ethereum | Logic | $19K |
| Abracadabra / MIM ZeroXStargateLPSwapper ExploitArbitrary-Calldata Approval Drain | Jun 2023 | Ethereum | Dependency | $17K |
| CFC ExploitSelf-Burning sync() + skim() Reserve Drain | Jun 2023 | BNB Chain | Oracle Manipulation | $16K |
| UN Token ExploitFee-on-swap-out + skim() Reserve Drain | Jun 2023 | BNB Chain | Oracle Manipulation | $13.4K |
| Bunny Protocol (BUNN) ExploitReflection deliver() Inflates Pair Balance, Spoofing the AMM K-Check | Jun 2023 | BNB Chain | Oracle Manipulation | $12K |
| OceanLife (OLIFE) ExploitReflection-Rate Collapse Inflates the Pool's Token Balance | Apr 2023 | BNB Chain | Logic | $9.7K |
| Axioma (AXT) ExploitMispriced Presale Sells Tokens Far Below the AMM Market Price | Apr 2023 | BNB Chain | Oracle Manipulation | $6.4K |
| Viral Inu (VINU) ExploitPermissionless addLiquidityETH() Drains Pool's Own Token Reserve | Jun 2023 | Ethereum | Access Control | $6K |
| Unverified Staking Contractclaim() Double-Spend of Deposited BUSD | Jun 2023 | BNB Chain | Logic | $6K |
| HODL Capital ExploitReflection-Rate Manipulation via deliver() Drains the Uniswap Pair | May 2023 | Ethereum | Logic | $4.3K |
| NOON (NO) ExploitPublic _transfer() Lets Anyone Drain the AMM Pool For Free | May 2023 | Ethereum | Access Control | $2K |
| SellToken ExploitSpot-Price Oracle Manipulation of a Leveraged "Short" Exchange | May 2023 | BNB Chain | Oracle Manipulation | $1K |
| FAPEN (Father Pepe Inu) Exploitunstake() Mints Free Tokens via Backwards Balance Check | May 2023 | BNB Chain | Access Control | $600 |
| STRAC ExploitPermissionless Token-Drainer in a Helper Contract (Spoofable transferFrom) | Jun 2023 | BNB Chain | Access Control | $13 |
| MyAi (CoinToken) ExploitMultiSender Lets Anyone Spend a Victim's Pre-Approved Allowance Into a Hyper-Thin Pool | Jun 2023 | BNB Chain | Access Control | not in dollars |
| SELLC / QIQI StakingRewards ExploitAttacker-Chosen Reward-Valuation Token Drains the Reward Pool | May 2023 | BNB Chain | Oracle Manipulation | not in dollars |
| Silo Finance Logic-Error ExploitInterest-Rate Manipulation Drains the Entire XAI Market for ~$0 | Apr 2023 | Ethereum | Oracle Manipulation | not in dollars |
| SNK Miner ExploitInflated Referral Reward via Just-In-Time Child Staking | May 2023 | BNB Chain | Logic | not in dollars |
| Swapos V2 Pair ExploitBroken k-Value Invariant Lets 10 wei of WETH Drain ~98% of the Pool's SWP | Apr 2023 | Ethereum | Arithmetic | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.