Hacks / Statistics / Q3 2024
Q3 2024 Exploit Report
July–September 2024: 42 reproduced exploits, $33.1M in stated losses.
42 exploits from July–September 2024 are reproduced in the library, 16 fewer than in Q2 2024. 38 of them state a dollar loss, $33.1M in total, against $88.2M the quarter before. Access Control was the most common root-cause category, on 20 of the 42 incidents (48%). Ethereum had both the most incidents (27) and the largest stated losses ($30M). The largest stated loss was LI.FI Protocol Exploit at $10M, 30% of the quarter's stated total.
Incidents
42
58 in Q2 2024.
Stated losses
$33.1M
38 of 42 incidents state a dollar figure. $88.2M in Q2 2024.
Largest stated loss
$10M
LI.FI Protocol Exploit
Most common root cause
Access Control
On 20 of 42 incidents.
Root causes
How many of the quarter's incidents carry each category.
Access Control20Logic19Oracle Manipulation11DeFi6Dependency5Arithmetic4Reentrancy2Untagged2
An incident with two categories counts under both.
View as table
| Category | Incidents | Stated losses |
|---|---|---|
| Access Control | 20 | $26.7M |
| Logic | 19 | $11.9M |
| Oracle Manipulation | 11 | $6.5M |
| DeFi | 6 | $199K |
| Dependency | 5 | $11.9M |
| Arithmetic | 4 | $3.2M |
| Reentrancy | 2 | $26K |
| Untagged | 2 | $56.3K |
Chains
Where the exploited contracts were deployed.
Ethereum27BNB Chain14Blast1
View as table
| Chain | Incidents | Stated losses |
|---|---|---|
| Ethereum | 27 | $30M |
| BNB Chain | 14 | $1.7M |
| Blast | 1 | $1.4M |
Largest stated losses
The 5 incidents of the quarter with the largest stated loss. Select a bar to open the write-up.
LI.FI Protocol Exploit$10MPenpie Exploit$5.6MShezmu Exploit$4.9MOnyx Protocol (OnyxDAO) Exploit$3.8MDoughFina Exploit$1.8M
View as table
| Incident | Chain | Stated loss |
|---|---|---|
| LI.FI Protocol Exploit | Ethereum | $10M |
| Penpie Exploit | Ethereum | $5.6M |
| Shezmu Exploit | Ethereum | $4.9M |
| Onyx Protocol (OnyxDAO) Exploit | Ethereum | $3.8M |
| DoughFina Exploit | Ethereum | $1.8M |
Every incident of the quarter
Largest stated loss first. Each opens the root-cause write-up and the runnable replay.
| Incident | When | Chain | Root cause | Stated loss |
|---|---|---|---|---|
| LI.FI Protocol ExploitArbitrary External Call via Unvalidated depositToGasZipERC20 | Jul 2024 | Ethereum | Dependency | $10M |
| Penpie ExploitFake-Market Reward Inflation via Attacker-Controlled getRewardTokens() | Sep 2024 | Ethereum | Access Control | $5.6M |
| Shezmu ExploitUnprotected mint() on the Vault Collateral Token | Sep 2024 | Ethereum | Access Control | $4.9M |
| Onyx Protocol (OnyxDAO) ExploitEmpty-Market Exchange-Rate Inflation + Attacker-Controlled oTokenRepay Liquidation | Sep 2024 | Ethereum | Access Control | $3.8M |
| DoughFina ExploitPermissionless Flash-Loan Connector Drains Any User's DSA | Jul 2024 | Ethereum | Access Control | $1.8M |
| Bedrock DeFi (uniBTC) Exploitmint() Prices Native ETH 1:1 as Native BTC | Sep 2024 | Ethereum | Logic | $1.7M |
| Minterest (Mantle) ExploitStale Exchange-Rate in lendRUSDY Inflates mUSDY Collateral | Jul 2024 | Blast | Oracle Manipulation | $1.4M |
| Caterpillar Coin (CUT) ExploitLP-Removal "Value Preservation" Mints Free Tokens | Sep 2024 | BNB Chain | Logic | $1.3M |
| VOW / Vow Finance ExploitPermissionless 100× VOW→vUSD tokensReceived Mint Mispricing | Aug 2024 | Ethereum | Oracle Manipulation | $1M |
| Planet Finance (PLN) ExploitZero-Amount Transfer Triggers Uncompensated Pool Burn | Sep 2024 | Ethereum | Logic | $400K |
| Convergence Finance ExploitUnvalidated claimContracts Lets a Fake Staking Contract Mint the Entire Staking Allocation | Aug 2024 | Ethereum | Access Control | $200K |
| DeFiPlaza ExploitConstant-Product swap Degenerates When the Input Reserve Is Drained to Zero | Jul 2024 | Ethereum | Oracle Manipulation | $200K |
| iVestDAO Exploitskim() Re-Routed Through a Reflection Token's Burn-Donation Hook | Aug 2024 | BNB Chain | Logic | $190K |
| WXETA (Wrapped Xeta) ExploitUnprotected Diamond-Facet initialize() → Unlimited Mint → AMM Pool Drain | Sep 2024 | BNB Chain | Access Control | $110K |
| Unverified MEV/Arb Contract 0x452E25…Unauthenticated uniswapV3SwapCallback Drains Its Own WETH | Jul 2024 | Ethereum | Access Control | $90.3K |
| Spectra Finance ExploitArbitrary External Call via the Router's KYBER_SWAP Command | Jul 2024 | Ethereum | Access Control | $73K |
| SmartBank (SBT) ExploitSelf-Referential Spot-Price Oracle Manipulation | Jul 2024 | BNB Chain | Oracle Manipulation | $56.5K |
| AAVE ParaSwap Repay AdapterLingering Allowance + Arbitrary-Call Collateral Drain | Aug 2024 | Ethereum | Untagged | $56K |
| GAX Swap ExploitCaller-Dictated Output Amount With No Input/Price Check | Jul 2024 | BNB Chain | Logic | $49.6K |
| Yodl Router ExploitPermissionless transferFee() Drains Pre-Approved User Allowances | Aug 2024 | Ethereum | Access Control | $47.8K |
| OTSea Staking Exploitclaim() Re-Arms Already-Withdrawn Deposits (Double-Withdraw Drain) | Sep 2024 | Ethereum | Logic | $26K |
| NovaX M2E ExploitStake/Withdraw USD-Value Sandwich via Manipulable AMM Oracle | Aug 2024 | BNB Chain | Oracle Manipulation | $25.2K |
| Zenterest ExploitStale-Oracle Collateral Mispricing on a Compound Fork | Aug 2024 | Ethereum | Oracle Manipulation | $21K |
| MEV Bot 0xDd7c…3685 ExploitForgeable Uniswap-V3 Callback Authentication | Jul 2024 | Ethereum | Access Control | $19K |
| Sniper-Bot ExploitUnprotected Arbitrary-Call Function Drains a Standing WETH Allowance | Sep 2024 | Ethereum | Access Control | $12K |
| OMPxContract ExploitPurchase/BuyBack Price Asymmetry Round-Trip Drain | Aug 2024 | Ethereum | Logic | $11.5K |
| INUMI ExploitUnprotected setMarketingWallet() Hijacks the rescueEth() Recipient | Sep 2024 | Ethereum | Access Control | $11K |
| 0x8DE7…34E9 ExploitPermissionless grantRole Lets Anyone Self-Grant Admin and Drain the Bridge/Custody Handler | Aug 2024 | BNB Chain | Access Control | $10.5K |
| LinkingTheWorld (LW) Exploit_internalSwap Underflow Mints Infinite Self-Balance & Drains the Fee Pool | Jul 2024 | BNB Chain | Arithmetic | $7.4K |
| DOGGO ExploitAttacker-Triggered Tax Auto-Sell Self-Sandwich | Sep 2024 | Ethereum | DeFi | $7K |
| AIRBTC ExploitPermissionless done() Token-Sweep Drain of a Helper Contract | Sep 2024 | BNB Chain | Access Control | $6.8K |
| MARA (MaraToken) ExploitPermissionless Mint via an Unprotected "Buy" Proxy that is a Token Keeper | Sep 2024 | BNB Chain | Access Control | $4.8K |
| Unverified 0x03F9… ExploitPermissionless Uniswap V3 Swap-Callback WETH Drain | Sep 2024 | Ethereum | Access Control | $1.7K |
| PESTO (Pesto The Baby King Penguin) ExploitFlash-Loan-Driven Tax Auto-Swap Self-Sandwich | Sep 2024 | Ethereum | DeFi | $1.3K |
| Unverified 0xb309…28Cb MEV RouterUnprotected uniswapV3SwapCallback Token Drain | Sep 2024 | Ethereum | Access Control | $900 |
| 0x16D0… ExploitPermissionless multiCallWithRevert Arbitrary-Call Allowance Drain | Sep 2024 | Ethereum | Untagged | $329 |
| HANA Token ExploitTax-Swap Self-Dump Price Manipulation via Forced Auto-Sell | Sep 2024 | Ethereum | DeFi | $283 |
| 0x71cd Swap-Helper ExploitPermissionless pancakeV3SwapCallback Drains a Pre-Approved Victim | Sep 2024 | BNB Chain | Access Control | $100 |
| Bankroll Network Stack ExploitSelf-Buy Dividend Inflation via buyFor(bankRoll, …) | Sep 2024 | BNB Chain | Logic | not in dollars |
| COCO COIN IncidentAbused USDT Allowance Drained via the COCO/USDT Pool | Aug 2024 | BNB Chain | DeFi | not in dollars |
| MRP / WMRP ExploitERC314 Add/Remove-Liquidity Reserve Drain via Re-entrant Self-Buy | Jul 2024 | BNB Chain | Reentrancy | not in dollars |
| Pythia Staking ExploitReward-Debt Reset via Receipt-Token Transfer | Sep 2024 | Ethereum | Logic | not in dollars |
A loss is the first dollar figure the write-up states, often for the reproduced transaction and sometimes for the whole campaign. The library counts exploits reproduced here, not every incident in the industry. How these numbers are made.