Hacks / Statistics / Q4 2023
Q4 2023 Exploit Report
October–December 2023: 68 reproduced exploits, $27.5M in stated losses.
68 exploits from October–December 2023 are reproduced in the library, 13 more than in Q3 2023. 62 of them state a dollar loss, $27.5M in total, against $77.6M the quarter before. Access Control was the most common root-cause category, on 30 of the 68 incidents (44%). BNB Chain had the most incidents (35), while Ethereum carried the largest stated losses ($17M). The largest stated loss was Raft Finance Exploit at $3.2M, 12% of the quarter's stated total.
Incidents
68
55 in Q3 2023.
Stated losses
$27.5M
62 of 68 incidents state a dollar figure. $77.6M in Q3 2023.
Largest stated loss
$3.2M
Raft Finance Exploit
Most common root cause
Access Control
On 30 of 68 incidents.
Root causes
How many of the quarter's incidents carry each category.
Access Control30Logic25Oracle Manipulation19DeFi18Arithmetic14Dependency6Reentrancy5Governance2Input Validation2Bridge1
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Access Control | 30 | $8M |
| Logic | 25 | $10.1M |
| Oracle Manipulation | 19 | $5.6M |
| DeFi | 18 | $3.4M |
| Arithmetic | 14 | $7M |
| Dependency | 6 | $1.7M |
| Reentrancy | 5 | $8M |
| Governance | 2 | $3.3M |
| Input Validation | 2 | $2M |
| Bridge | 1 | $200K |
| Untagged | 1 | $23K |
Chains
Where the exploited contracts were deployed.
BNB Chain35Ethereum27Arbitrum2Avalanche2Base1Polygon1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| BNB Chain | 35 | $3.9M |
| Ethereum | 27 | $17M |
| Arbitrum | 2 | $465K |
| Avalanche | 2 | $4.9M |
| Base | 1 | $53K |
| Polygon | 1 | $1.2M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
Raft Finance Exploit$3.2MNFTTrader Exploit$3MStars Arena Exploit$2.9M"bot" / MEV-bot Router Exploit$2MGoodDollar Exploit$2M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| Raft Finance Exploit | Ethereum | $3.2M |
| NFTTrader Exploit | Ethereum | $3M |
| Stars Arena Exploit | Avalanche | $2.9M |
| "bot" / MEV-bot Router Exploit | Ethereum | $2M |
| GoodDollar Exploit | Ethereum | $2M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| Raft Finance ExploitIndexable-Collateral setIndex Inflation + divUp Rounding Mint | Nov 2023 | Ethereum | Arithmetic | $3.2M |
| NFTTrader ExploitReentrancy via editCounterPart() During Swap Settlement | Dec 2023 | Ethereum | Reentrancy | $3M |
| Stars Arena ExploitbuyShares Reentrancy Inflates the Price-Curve Weight | Oct 2023 | Avalanche | Reentrancy | $2.9M |
| "bot" / MEV-bot Router ExploitPermissionless, Zero-Slippage Forced Swaps + Sandwich Drain | Nov 2023 | Ethereum | Access Control | $2M |
| GoodDollar ExploitUnvalidated collectInterest Staking-Contract Callback → Reentrant Bonding-Curve Drain | Dec 2023 | Ethereum | Input Validation | $2M |
| Onyx Protocol ExploitEmpty-Market Exchange-Rate Inflation (Compound V2 Fork) | Nov 2023 | Ethereum | Arithmetic | $2M |
| Platypus Finance (PoolSAvax) ExploitWithdraw-While-Insolvent Coverage-Ratio Manipulation | Oct 2023 | Avalanche | Logic | $2M |
| Floor Protocol ExploitPermissionless extMulticall() Drains User-Approved NFTs | Dec 2023 | Ethereum | Access Control | $1.6M |
| BH ExploitSpot-Reserve-Priced Liquidity Manager Drained via Flash-Loan Price Manipulation | Oct 2023 | BNB Chain | Oracle Manipulation | $1.3M |
| Telcoin ExploitUninitialized CloneableProxy Hijacked via Public initialize() | Dec 2023 | Polygon | Access Control | $1.2M |
| DePayRouterV1 ExploitOutput-Only Balance Check + Repeated Plugin Execution Drains Router Funds | Oct 2023 | Ethereum | Logic | $827K |
| HopeLend ExploitLiquidity-Index Inflation + aToken Rounding-Error Drain | Oct 2023 | Ethereum | Arithmetic | $825K |
| BEARN/Bvaults convertDustToEarned() ExploitPermissionless, Slippage-Free Dump of a Strategy's "Dust" Balance | Dec 2023 | BNB Chain | Access Control | $769K |
| FCN-TRUST Staking ExploitUnverified Staking Contract Pays Unbounded FCN Rewards Drained Through a Pre-Inflated FCN/BUSDT Pool | Dec 2023 | BNB Chain | Logic | $500K |
| MEV Bot 0x8c2d ExploitPermissionless Asset-Harvester Drains a Pre-Approved Victim | Nov 2023 | BNB Chain | Access Control | $365K |
| Channels Finance ExploitCompound-Fork Exchange-Rate Inflation via Donated Underlying | Dec 2023 | BNB Chain | Oracle Manipulation | $320K |
| TheStandard.io ExploitSmartVault swap() with Zero Slippage Protection Through an Attacker-Controlled Pool | Nov 2023 | Arbitrum | DeFi | $290K |
| Wise Lending ExploitFirst-Depositor Share Inflation via pseudoTotalPool Donation | Oct 2023 | Ethereum | Arithmetic | $260K |
| Astrid Protocol Exploitwithdraw() Trusts an Attacker-Supplied "Restaked Token" | Oct 2023 | Ethereum | Access Control | $229K |
| bZx / Fulcrum iToken ExploitEmpty-Pool Share-Price Inflation (ERC4626-style Donation Attack) | Dec 2023 | Ethereum | Arithmetic | $208K |
| HYPR ExploitUninitialized L1StandardBridge Proxy → Cross-Domain Messenger Spoof → Bridge Drain | Dec 2023 | Ethereum | Access Control | $200K |
| TIME (ChronoTech) ExploitERC-2771 + Multicall Arbitrary _msgSender() Spoofing → Pool-Reserve Burn | Dec 2023 | Ethereum | Access Control | $185K |
| BelugaDex ExploitStableswap Coverage-Ratio Manipulation via Deposit / Cross-Asset-Swap / Withdraw Looping | Oct 2023 | Arbitrum | Oracle Manipulation | $175K |
| TrustPad LaunchpadLockableStaking ExploitDeposit/Withdraw Reward-Accounting Desync | Nov 2023 | BNB Chain | Logic | $155K |
| MEV-Bot Fleet Exploit (0xa247…)Unprotected removeAdmin() Lets Anyone Seize and Drain 24 Bot Contracts | Nov 2023 | Ethereum | Access Control | $150K |
| Elephant Money (ElephantStatus) ExploitSpot-Price Oracle Manipulation of sweep() | Dec 2023 | BNB Chain | Oracle Manipulation | $114K |
| Pine Protocol ExploitShared-Vault flashLoan Invariant Bypassed by Cross-Pool repay() | Dec 2023 | Ethereum | Logic | $90K |
| UniBot Router ExploitArbitrary External Call Drains Unlimited Approvals | Oct 2023 | Ethereum | Dependency | $84K |
| AI SPACE (AIS) ExploitPermissionless PendingMint Inflation + Unprotected Vault Drain | Nov 2023 | BNB Chain | Access Control | $60.7K |
| CAROL Protocol ExploitReentrancy in sell() via Mid-Function ETH Payout to Attacker | Nov 2023 | Base | Reentrancy | $53K |
| 9419 (8633/0cCa) ExploitPermissionless autoAddLp() / autoSwapAndAddToMarketing() Reserve Manipulation | Nov 2023 | BNB Chain | Access Control | $52K |
| GROK Token ExploitFee-on-Transfer Tax Auto-Swap Reserve Desync | Nov 2023 | Ethereum | Reentrancy | $50K |
| Transit Finance (TransitSwap V5) ExploitForged "Pool" in exactInputV3Swap Drains Router-Held Funds | Dec 2023 | BNB Chain | Input Validation | $43.8K |
| 3913 Token Exploitskim-Driven Invite-Bonus / LP-Burn Vault Drain | Nov 2023 | BNB Chain | DeFi | $31.4K |
| SHIBAINU DAO ExploitUnderpriced ICO Sale + Lock-Bypassing batchTransferLockToken Pool Drain | Nov 2023 | BNB Chain | Oracle Manipulation | $31K |
| LinkDao ExploitMis-scaled Constant-Product K Check in a Custom Uniswap-V2 Fork | Nov 2023 | BNB Chain | Arithmetic | $30K |
| StakeStone StoneVault ExploitSame-Block Deposit + instantWithdraw Skims Strategy-Realization Surplus | Nov 2023 | Ethereum | DeFi | $30K |
| KyberSwap Elastic ExploitTick-Boundary Precision Loss Doubles Pool Liquidity | Nov 2023 | Ethereum | Untagged | $23K |
| EEE-COIN ExploitFlash-Loan Reserve Manipulation via a Compromised LP-Holder Router | Nov 2023 | BNB Chain | Oracle Manipulation | $22.8K |
| MahaLend ExploitEmpty-Reserve Liquidity-Index Inflation + Share-Rounding Theft | Nov 2023 | Ethereum | Arithmetic | $20K |
| TheNFTV2 ExploitBroken transferFrom Access Control Lets Anyone Re-Pull Burned NFTs and Drain Their Wrapped DAO | Nov 2023 | Ethereum | Access Control | $19K |
| WECO Staking ExploitReward-Debt (offsetPoints) Unit Mismatch Lets a Depositor Re-Claim the Whole Reward Pool | Nov 2023 | BNB Chain | Arithmetic | $18K |
| KR Token ExploitPermissionless sellKr() Liquidity-Pool Drain | Nov 2023 | BNB Chain | Access Control | $15.2K |
| ZS Token ExploitPermissionless destory_pair_amount() Pool-Reserve Burn | Oct 2023 | BNB Chain | Access Control | $14K |
| GoodDollar GoodCompoundStaking ExploitSlippage-Free COMP Reward Swap into a Pre-Manipulated Pool | Dec 2023 | Ethereum | DeFi | $13K |
| MicDao ExploitFixed-Rate Presale Swap Arbitraged Against a Self-Manipulated AMM Pool | Oct 2023 | BNB Chain | Oracle Manipulation | $12.3K |
| Kerberus / kTAF ExploitCompound-Fork Exchange-Rate Inflation via a Donatable, Tiny-Cash Collateral Token | Oct 2023 | Ethereum | Arithmetic | $8.2K |
| OpenLeverage RewardVaultDelegator ExploitRe-initializable Proxy → Admin Takeover → Arbitrary delegatecall | Oct 2023 | BNB Chain | Access Control | $8K |
| OKC ExploitPermissionless processLPReward() Pays Out on a Flash-Minted LP Position | Nov 2023 | BNB Chain | Access Control | $6.3K |
| Channels Finance ExploitcToken Exchange-Rate Inflation via Direct LP Donation + LP-Oracle Manipulation | Dec 2023 | BNB Chain | Oracle Manipulation | $4.4K |
| MetaLend ExploitEmpty-Market Exchange-Rate Inflation via selfdestruct Donation | Nov 2023 | Ethereum | Arithmetic | $4K |
| MAMO (Matmo) ExploitPermissionless Mint via Whitelisted BuyToken → giveawayOne | Dec 2023 | BNB Chain | Access Control | $3.3K |
| CCV ExploitPermissionless Treasury-Proxy Forced Liquidation Sandwich | Dec 2023 | BNB Chain | Access Control | $3.2K |
| Burntbubba (LevX / FarmingLPToken) ExploitSpot-Price Share Minting Manipulated via Attacker-Created Routing Pools | Nov 2023 | Ethereum | Oracle Manipulation | $3K |
| KEST (KEKESANTA) ExploitFee-on-Transfer Reserve De-Sync + skim() Pool Drain | Dec 2023 | BNB Chain | Logic | $2.3K |
| pSeudoEth (pEth) Exploitskim()-Pumped Reflection Token Drains the AMM Pool | Oct 2023 | Ethereum | DeFi | $2.3K |
| HNet ExploitERC-2771 + Multicall _msgSender() Spoofing Burns the Pool's Tokens | Dec 2023 | BNB Chain | Access Control | $550 |
| PHIL (PhilC) ExploitPublic, Unrestricted simpleToken() Mint Drains the AMM Pool | Dec 2023 | BNB Chain | Access Control | $510 |
| LaEeb ExploitFee-on-Transfer + Auto-Liquify Pool Drain via skim() Recycling | Oct 2023 | BNB Chain | Logic | $370 |
| XAI / CoinToken ExploitReflection-Token burn() Collapses Pool Balance via Un-touched _rTotal | Nov 2023 | BNB Chain | Logic | $160 |
| Swamp Finance ExploitAtomic earn() Harvest-Sandwich on StrategyBelt_Token | Nov 2023 | BNB Chain | Access Control | $110 |
| FiberRouter ExploitArbitrary External Call Drains a Victim's Token Approval | Nov 2023 | BNB Chain | Dependency | $59 |
| BCT Token ExploitSelf-Funding Referral-Reward Drain of the Promotion Pool | Dec 2023 | BNB Chain | Access Control | not in dollars |
| BOBO_BOY (BOB) ExploitBroken _transfer Fee Branches Desync Pool Reserves | Dec 2023 | BNB Chain | Logic | not in dollars |
| BrandPad (BRAND) ExploitPermissionless buyToken() Buyback-Bot Sandwich | Nov 2023 | BNB Chain | Access Control | not in dollars |
| DominoTT Exploitthirdweb Multicall + ERC2771 _msgSender() Spoofing Burns the Pool's Tokens | Dec 2023 | BNB Chain | Access Control | not in dollars |
| EHX (Eterna) ExploitFee-on-Transfer / AMM skim Drain | Nov 2023 | BNB Chain | DeFi | not in dollars |
| Maestro Router 2 ExploitArbitrary transferFrom via Unvalidated Router Call | Oct 2023 | Ethereum | Access Control | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.