Hacks / Statistics / Q3 2023
Q3 2023 Exploit Report
July–September 2023: 55 reproduced exploits, $77.6M in stated losses.
55 exploits from July–September 2023 are reproduced in the library, 5 fewer than in Q2 2023. 50 of them state a dollar loss, $77.6M in total, against $74.1M the quarter before. Logic was the most common root-cause category, on 29 of the 55 incidents (53%). Ethereum had both the most incidents (26) and the largest stated losses ($65.7M). The largest stated loss was Curve crv/ETH Pool Drain at $41M, 53% of the quarter's stated total.
Incidents
55
60 in Q2 2023.
Stated losses
$77.6M
50 of 55 incidents state a dollar figure. $74.1M in Q2 2023.
Largest stated loss
$41M
Curve crv/ETH Pool Drain
Most common root cause
Logic
On 29 of 55 incidents.
Root causes
How many of the quarter's incidents carry each category.
Logic29Oracle Manipulation25Access Control16DeFi15Arithmetic9Governance9Reentrancy5Dependency4Untagged3Authentication2
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Logic | 29 | $11.5M |
| Oracle Manipulation | 25 | $11.2M |
| Access Control | 16 | $9.4M |
| DeFi | 15 | $895K |
| Arithmetic | 9 | $3.8M |
| Governance | 9 | $5.2M |
| Reentrancy | 5 | $4.3M |
| Dependency | 4 | $379K |
| Untagged | 3 | $55.7M |
| Authentication | 2 | $130K |
| Input Validation | 1 | $9.7K |
Chains
Where the exploited contracts were deployed.
Ethereum26BNB Chain22Arbitrum2Base2Polygon2Avalanche1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 26 | $65.7M |
| BNB Chain | 22 | $2.6M |
| Arbitrum | 2 | $936K |
| Base | 2 | $7.9M |
| Polygon | 2 | $452K |
| Avalanche | 1 | $51K |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Curve crv/ETH Pool Drain$41MCurve Finance pETH/ETH Pool$11.4MExactly Protocol Exploit$7.3MConic Finance (ETH Omnipool)$3.3MConic Finance ETH Omnipool Exploit$3.3M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Curve crv/ETH Pool Drain | Ethereum | $41M |
| Curve Finance pETH/ETH Pool | Ethereum | $11.4M |
| Exactly Protocol Exploit | Base | $7.3M |
| Conic Finance (ETH Omnipool) | Ethereum | $3.3M |
| Conic Finance ETH Omnipool Exploit | Ethereum | $3.3M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Curve crv/ETH Pool DrainVyper 0.3.0 Broken @nonreentrant Lock (Read-Only/Cross-Function Reentrancy) | Jul 2023 | Ethereum | Untagged | $41M |
| Curve Finance pETH/ETH PoolVyper @nonreentrant Compiler Bug Read-Only/Cross-Function Reentrancy | Jul 2023 | Ethereum | Untagged | $11.4M |
| Exactly Protocol ExploitDebtManager Permit-Spoofed _msgSender Lets Anyone Act On Behalf Of Any Account | Aug 2023 | Base | Access Control | $7.3M |
| Conic Finance (ETH Omnipool)Curve LP Oracle Manipulation via Spot-Reserve Pricing | Jul 2023 | Ethereum | Untagged | $3.3M |
| Conic Finance ETH Omnipool ExploitCurve Read-Only Reentrancy Oracle Inflation | Jul 2023 | Ethereum | Reentrancy | $3.3M |
| Balancer Boosted Pools ExploitLinear-Pool getRate() Inflation via BPT Supply Drain + Precision Loss | Aug 2023 | Ethereum | Oracle Manipulation | $2.1M |
| Zunami UZD ExploitSpot-Price totalHoldings() Inflation via SDT Donation | Aug 2023 | Ethereum | Oracle Manipulation | $2.1M |
| Conic Finance (crvUSD Omnipool) ExploitCurve Pool Imbalance Manipulation of LP Valuation | Jul 2023 | Ethereum | Oracle Manipulation | $934K |
| Palmswap ExploitPLP Share Inflation via Permissionless buyUSDP() AUM Manipulation | Jul 2023 | BNB Chain | Oracle Manipulation | $901K |
| Rodeo Finance ExploitTWAP Oracle Manipulation of the unshETH LP Price | Jul 2023 | Arbitrum | Oracle Manipulation | $888K |
| LeetSwap V2 ExploitPublic _transferFeesSupportingTaxTokens() Drains the Pair's Reserves | Aug 2023 | Base | Access Control | $630K |
| BNO ExploitemergencyWithdraw() Resets Stake but Leaves Reward Accounting Intact, Draining the Pool | Jul 2023 | BNB Chain | Logic | $505K |
| Libertify (LibertiVault) ExploitDeposit Reentrancy via 1inch Swap Callback Inflates Share Mint | Jul 2023 | Polygon | Reentrancy | $452K |
| SVT ExploitBroken AMM Pricing Round-Trip Drain (flash-loan funded) | Aug 2023 | BNB Chain | Oracle Manipulation | $398K |
| Arcadia Finance ExploitReentrant Self-Liquidation Drains the Lending Pools | Jul 2023 | Ethereum | Reentrancy | $334K |
| Uwerx (WERX) ExploitBurn-on-Transfer-to-Pool + skim() Reserve Collapse | Aug 2023 | Ethereum | DeFi | $320K |
| EarningFarm (ENF) ExploitWithdraw Reentrancy via ETH-Push-Before-Burn in EFVault | Aug 2023 | Ethereum | Reentrancy | $286K |
| CIVNFT / CivTrade ExploitMissing Access Control + Attacker-Controlled Mint Callback Drains Approved Allowances | Jul 2023 | Ethereum | Access Control | $180K |
| APIG Token ExploitSelf-Transfer Balance-Doubling Bug Drains Two Pools | Sep 2023 | BNB Chain | Arithmetic | $169K |
| Civfund (0xf485) ExploitForged Uniswap-V3 mint Callback Drains User Approvals | Jul 2023 | Ethereum | Access Control | $165K |
| Utopia Exploit_airdrop() Overwrites the Pool's Token Balance to 1, Collapsing the AMM Reserve | Jul 2023 | BNB Chain | Logic | $119K |
| FFIST (FIRE FIST) ExploitAttacker-Controlled _airdrop() Overwrites the AMM Pool's Token Balance to 1 wei | Jul 2023 | BNB Chain | Logic | $110K |
| Carson Token ExploitThin-Reserve Price Skew + Fee-on-Transfer Drain via a Custom Pair | Jul 2023 | BNB Chain | Oracle Manipulation | $101K |
| WGPT (Wrapped GPT) ExploitSelf-Inflicted removeLiquidity on Every Sell Drains the Pool | Jul 2023 | BNB Chain | DeFi | $80K |
| AzukiDAO (Bean) ExploitSignature-Replay Mint via Unenforced signatureClaimed Guard | Jul 2023 | Ethereum | Authentication | $69K |
| FloorDAO ExploitSelf-Donated Rebase Inflates the Staking index, Over-Paying gFLOOR Redemptions | Sep 2023 | Ethereum | Logic | $64K |
| 0x0 Privacy DEX (OxODex) ExploitForged LSAG Ring Signature + Stale _lastWithdrawal Pool Drain | Sep 2023 | Ethereum | Authentication | $61K |
| Platypus Finance (2nd hack)Coverage-Ratio Arbitrage via withdrawFromOtherAsset | Jul 2023 | Avalanche | Logic | $51K |
| Neutra Finance ExploitConvert.getAmountOut() Prices LP by a Spot-Manipulable Reserve | Aug 2023 | Arbitrum | Oracle Manipulation | $48K |
| Bao Finance ExploitCErc20 Exchange-Rate Inflation via Direct Underlying Donation | Jul 2023 | Ethereum | Oracle Manipulation | $46K |
| BFCToken ExploitlastTx Deferred Pool-Burn Desyncs PancakeSwap Reserves | Sep 2023 | BNB Chain | DeFi | $38K |
| Curve UnderlyingBurner.execute()Zero-Slippage Sandwich on the 3pool | Aug 2023 | Ethereum | DeFi | $36.7K |
| NewFi / StakedV3 ExploitFlash-Loan Price Manipulation of an Unprotected Internal V3 Swap | Jul 2023 | BNB Chain | Oracle Manipulation | $31K |
| CEXISWAP ExploitUnprotected initialize() + UUPS Arbitrary Upgrade Drain | Sep 2023 | Ethereum | Access Control | $30K |
| GSS ExploitFee-on-Transfer / Reflection Token Drained via Cross-Pool skim() | Aug 2023 | BNB Chain | DeFi | $24.9K |
| Split (Kub) ExploitSelf-Doubling Balance via Manipulable On-Chain "Token Price" Oracle | Sep 2023 | BNB Chain | Oracle Manipulation | $22.2K |
| USDTStakingContract28 ExploitPermissionless tokenAllowAll() Self-Approval Drain | Jul 2023 | Ethereum | Access Control | $21K |
| DAppSocial ExploitwithdrawTokensWithAlt Credits Instead of Debiting the Depositor Ledger | Sep 2023 | Ethereum | Logic | $16K |
| EHIVE Exploitstake() Updates staked Before Computing earned, Inflating Rewards | Aug 2023 | Ethereum | Logic | $15K |
| Heavens Gate (HATE) ExploitRebase-Index Inflation via Permissionless stake/unstake Looping | Sep 2023 | Ethereum | Logic | $13K |
| BankX / XSD ExploitRouter swapXSDForETH() Triggers an Un-Compensated Pool Burn | Sep 2023 | BNB Chain | Logic | $12.5K |
| Minto Finance ExploitFree BTCMT Minting via Unvalidated paymentToken in ReferralCrowdsale.buyTokens() | Jul 2023 | BNB Chain | Input Validation | $9.7K |
| LUSD (LAYER3) ExploitSpot-Price Oracle Manipulation via Loan.supply() | Jul 2023 | BNB Chain | Oracle Manipulation | $9.5K |
| HCT (CoinToken) ExploitReflection-Token burn() Deflates the Pool's Reserve to 1 wei | Sep 2023 | BNB Chain | Logic | $8.6K |
| SUT Token Sale ExploitFixed-Price Inventory Sold Far Below Market | Jul 2023 | BNB Chain | Oracle Manipulation | $8K |
| ApeDAO (APE2) ExploitPermissionless goDead() Pool-Reserve Burn + skim() Tax Pump | Jul 2023 | BNB Chain | Access Control | $7.5K |
| EAC ExploitPermissionless _swapUForToken() Drains the Fund Contract into a Thin Pool | Aug 2023 | BNB Chain | Access Control | $6.4K |
| DEXRouter ExploitUnprotected functionCallWithValue Drains the Router's Native BNB | Sep 2023 | BNB Chain | Access Control | $4K |
| JumpFarm ExploitSingle-Transaction Rebase Inflation in OlympusDAO-style Staking | Sep 2023 | Ethereum | Logic | $2.4K |
| Quantum Wealth Network (QWA) ExploitRe-entrant rebase() Reward Harvest via stake/unstake Looping | Sep 2023 | Ethereum | Logic | $900 |
| Bamboo AI ExploitupdatePool() Permissionless Pool-Reserve Siphon + skim/sync Drain | Jul 2023 | BNB Chain | Oracle Manipulation | not in dollars |
| BTC20 / 24Pixels Presale ExploitSpot-AMM Price Oracle Manipulation in buyWithEthDynamic() | Aug 2023 | Ethereum | Oracle Manipulation | not in dollars |
| FireBird Finance ExploitManipulable Protocol-Fee LP Mint Drains the WMATIC/HOPE Pool | Sep 2023 | Polygon | DeFi | not in dollars |
| GYM Network ExploitGymRouter Pulls Swap Input From the Recipient Instead of the Caller | Jul 2023 | BNB Chain | Logic | not in dollars |
| Unicly PointFarm ExploitERC1155 Reentrancy Inflates Reward Points to Steal a LootRealms NFT | Sep 2023 | Ethereum | Reentrancy | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.