DeFi Hacks Reproduce - Foundry
November 28, 2025 ยท View on GitHub
2023 - List of Past DeFi Incidents
214 incidents included.
20231201 UnverifiedContr_0x431abb
20230715 USDTStakingContract28
20230627 UnverifiedContr_9ad32
20231231 Channels - Price Manipulation
Lost: ~$4.4K
forge test --contracts ./src/test/2023-12/Channels_exp.sol -vvv --evm-version shanghai
Contract
Link reference
20231230 ChannelsFinance - CompoundV2 Inflation Attack
Lost: ~320K
forge test --contracts src/test/2023-12/ChannelsFinance_exp.sol -vvv
Contract
Link reference
https://twitter.com/AnciliaInc/status/1741353303542501455
20231228 CCV - Precision loss
Lost: ~3.2K $BUSD
forge test --contracts src/test/2023-12/CCV_exp.sol -vvv
Contract
Link reference
20231228 DominoTT - Precision loss
Lost: ~5 $WBNB
forge test --contracts src/test/2023-12/DominoTT_exp.sol -vvv
Contract
Link reference
20231225 Telcoin - Storage Collision
Lost: ~1,24M
forge test --contracts ./src/test/2023-12/Telcoin_exp.sol -vvv
Contract
Link reference
https://blocksec.com/phalcon/blog/telcoin-security-incident-in-depth-analysis
https://hacked.slowmist.io/?c=&page=2
20231222 PineProtocol - Business Logic Flaw
Lost: ~90k
forge test --contracts ./src/test/2023-12/PineProtocol_exp.sol -vvv
Contract
Link reference
https://medium.com/neptune-mutual/analysis-of-the-pine-protocol-exploit-e09dbcb80ca0
https://twitter.com/MistTrack_io/status/1738131780459430338
20231220 TransitFinance - Lack of Validation Pool
Lost: ~110k
forge test --contracts ./src/test/2023-12/TransitFinance_exp.sol -vvv
Contract
Link reference
https://twitter.com/Phalcon_xyz/status/1737355152779030570
20231217 Bob - Price Manipulation
Lost: ~3BNB
forge test --contracts ./src/test/2023-12/Bob_exp.sol -vvv --evm-version shanghai
Contract
Link reference
https://bscscan.com/tx/0xfb14292a531411f852993e5a3ba4e7eb63ed548220267b9b3f4aacc5572d3a58
20231217 FloorProtocol - Business Logic Flaw
Lost: ~$1,6M
forge test --contracts ./src/test/2023-12/FloorProtocol_exp.sol --evm-version 'shanghai' -vvv
Contract
Link reference
https://protos.com/floor-protocol-exploited-bored-apes-and-pudgy-penguins-gone/
https://twitter.com/0xfoobar/status/1736190355257627064
https://defimon.xyz/exploit/mainnet/0x7e5433f02f4bf07c4f2a2d341c450e07d7531428
20231216 GoodDollar - Lack of Input Validation & Reentrancy
Lost: ~$2M
forge test --contracts ./src/test/2023-12/GoodDollar_exp.sol -vvv
Contract
Link reference
https://twitter.com/MetaSec_xyz/status/1736428284756607386
20231216 KEST - Business Logic Flaw
Lost: ~$2.3K
forge test --contracts src/test/2023-12/KEST_exp.sol -vvv
Contract
Link reference
https://x.com/MetaSec_xyz/status/1736077719849623718
20231216 NFTTrader - Reentrancy
Lost: ~$3M
forge test --contracts ./src/test/2023-12/NFTTrader_exp.sol -vvv
Contract
Link reference
https://twitter.com/AnciliaInc/status/1736263884217139333
https://twitter.com/SlowMist_Team/status/1736005523550646535
https://twitter.com/0xArhat/status/1736038250190651467
20231214 PHIL - Business Logic Flaw
Lost: ~$2 $BNB
forge test --contracts ./src/test/2023-12/PHIL_exp.sol -vvv
Contract
Link reference
20231213 HYPR - Business Logic Flaw
Lost: ~$200k
forge test --contracts ./src/test/2023-12/HYPR_exp.sol -vvv
Contract
Link reference
https://twitter.com/BlockSecTeam/status/1735197818883588574
20231211 GoodCompound - Price Manipulation
Lost: ~$13K (~250 COMP Token)
forge test --contracts ./src/test/2023-12/GoodCompound_exp.sol -vvv
Contract
Link reference
https://getherscan.io/tx/0x1106418384414ed56cd7cbb9fedc66a02d39b663d580abc618f2d387348354ab
20231209 BCT - Price Manipulation
Lost: ~10.2BNB
forge test --contracts ./src/test/2023-12/BCT_exp.sol -vvv --evm-version shanghai
Contract
Link reference
https://bscscan.com/tx/0xdae0b85e01670e6b6b317657a72fb560fc388664cf8bfdd9e1b0ae88e0679103
20231207 HNet - Business logic flaw
Lost: ~2.4 $WBNB
forge test --contracts src/test/2023-12/HNet_exp.sol -vvv
Contract
Link reference
20231206 TIME - Arbitrary Address Spoofing Attack
Lost: ~84.59 ETH
Test
forge test --contracts ./src/test/2023-12/TIME_exp.sol -vvv
Contract
Link reference
20231206 ElephantStatus - Price Manipulation
Lost: ~$165k
Test
forge test --contracts ./src/test/2023-12/ElephantStatus_exp.sol -vvv
Contract
Link reference
https://twitter.com/Phalcon_xyz/status/1732354930529435940
20231205 MAMO - Price Manipulation
Lost: ~$3.3K
forge test --contracts ./src/test/2023-12/MAMO_exp.sol -vvv --evm-version shanghai
Contract
Link reference
https://bscscan.com/tx/0x189a8dc1e0fea34fd7f5fa78c6e9bdf099a8d575ff5c557fa30d90c6acd0b29f
20231205 BEARNDAO - Business Logic Flaw
Lost: ~$769k
Test
forge test --contracts ./src/test/2023-12/BEARNDAO_exp.sol -vvv
Contract
Link reference
https://twitter.com/AnciliaInc/status/1732159377749180646
20231202 bZxProtocol - Inflation Attack
Lost: ~$208k
Test
forge test --contracts ./src/test/2023-12/bZx_exp.sol -vvv
Contract
Link reference
https://x.com/MetaSec_xyz/status/1730811240942088263
20231201 UnverifiedContr_0x431abb - Business Logic Flaw
Lost: ~$500k
Test
forge test --contracts ./src/test/2023-12/UnverifiedContr_0x431abb_exp.sol -vvv
Contract
UnverifiedContr_0x431abb_exp.sol
Link reference
https://twitter.com/Phalcon_xyz/status/1730625352953901123
20231130 EEE - Price Manipulation
Lost: ~$22.8K
forge test --contracts ./src/test/2023-11/EEE_exp.sol -vvv --evm-version shanghai
Contract
Link reference
https://bscscan.com/tx/0x7312d9f9c13fc69f00f58e92a112a3e7f036ced7e65f7e0fa67382488d5557dc
20231130 CAROLProtocol - Price Manipulation Via Reentrancy
Lost: ~$53k
Testing
forge test --contracts ./src/test/2023-11/CAROLProtocol_exp.sol -vvv
Contract
Link reference
https://x.com/MetaSec_xyz/status/1730496513359647167
20231129 Burntbubba - Price Manipulation
Lost: ~$3K
Testing
forge test --contracts src/test/2023-11/Burntbubba_exp.sol -vvv
Contract
Link reference
https://x.com/MetaSec_xyz/status/1730044259087315046
20231129 AIS - Insufficient validation
Lost: ~$61k
Testing
forge test --contracts ./src/test/2023-11/AIS_exp.sol -vvv
Contract
Link reference
https://twitter.com/Phalcon_xyz/status/1729861048004391306
20231128 FiberRouter - input validation
Lost: 18 eth
Testing
forge test --contracts ./src/test/2023-11/FiberRouter_exp.sol -vvv
Contract
Link reference
https://x.com/MetaSec_xyz/status/1729323254610002277
20231125 MetaLend - CompoundV2 Inflation Attack
Lost: ~$4K
Test
forge test --contracts src/test/2023-11/MetaLend_exp.sol -vvv
Contract
Link Reference
https://x.com/MetaSec_xyz/status/1728424965257691173
20231125 TheNFTV2 - logic flaw
Lost: ~$19K
Test
forge test --contracts ./src/test/2023-11/TheNFTV2_exp.sol -vvv
Contract
Link Reference
https://x.com/MetaTrustAlert/status/1728616715825848377
20231122 KyberSwap - precision loss
Lost: ~$48M
The attacks were spread over 6 chains and 17 transactions.
Each transaction targeted and drained up to 5 pools from KyberSwap elastic CLAMM.
Test
All the pool hacks follow the same scheme as the first:
forge test --contracts ./src/test/2023-11/KyberSwap_exp.eth.1.sol -vvv
Contract
Link Reference
20231117 Token8633_9419 - Price Manipulation
Lost: ~$52K
Test
forge test --contracts ./src/test/2023-11/Token8633_9419_exp.sol -vvv
Contract
20231117 ShibaToken - Business Logic Flaw
Lost: ~$31K
Test
forge test --contracts ./src/test/2023-11/ShibaToken_exp.sol -vvv
Contract
20231116 WECO - Business Logic Flaw
Lost: ~$18K
Test
forge test --contracts ./src/test/2023-11/WECO_exp.sol -vvv
Contract
Link Reference
https://x.com/MetaSec_xyz/status/1725311048625041887
20231115 EHX - Lack of Slippage Control
Lost: Unclear
Test
forge test --contracts ./src/test/2023-11/EHX_exp.sol -vvv
Contract
Link Reference
https://x.com/MetaSec_xyz/status/1724691996638618086
20231115 XAI - Business Logic Flaw
Lost: Unclear
Test
forge test --contracts src/test/2023-11/XAI_exp.sol -vvv
Contract
Link Reference
https://x.com/MetaSec_xyz/status/1724683082064855455
20231115 LinkDAO - Bad K Value Verification
Lost: ~$30K
Test
forge test --contracts ./src/test/2023-11/LinkDao_exp.sol -vvv
Contract
Link Reference
https://x.com/phalcon_xyz/status/1725058908144746992
20231114 OKC Project - Instant Rewards, Unlocked
Lost: ~$6268
Test
forge test --contracts ./src/test/2023-11/OKC_exp.sol -vvv
Contract
Link Reference
https://lunaray.medium.com/okc-project-hack-analysis-0907312f519b
20231112 MEVBot_0x8c2d - Lack of Access Control
Lost: ~$365K
Test
forge test --contracts ./src/test/2023-11/MEV_0x8c2d_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1723897569661657553
20231112 MEVBot_0xa247 - Incorrect Access Control
Lost: ~$150K
Test
forge test --contracts ./src/test/2023-11/MEV_0xa247_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1723591214262632562
20231111 MahaLend - Donate Inflation ExchangeRate & Rounding Error
Lost: ~$20 K
Test
forge test --contracts ./src/test/2023-11/MahaLend_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1723223766350832071
20231110 Raft_fi - Donate Inflation ExchangeRate & Rounding Error
Lost: ~$3.2 M
Test
forge test --contracts ./src/test/2023-11/Raft_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1723229393529835972
20231110 grok - Lack of slippage protection
Lost: ~26 ETH
Test
forge test --contracts ./src/test/2023-11/grok_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1722841076120130020
20231107 RBalancer - Business Logic Flaw
Lost: ~17 ETH
Test
forge test --contracts ./src/test/2023-11/RBalancer_exp.sol -vvv --evm-version "shanghai"
Contract
Link Reference
https://x.com/AnciliaInc/status/1722121056083943909
20231107 MEVbot - Lack of access control
Lost: ~$2M
Test
forge test --contracts ./src/test/2023-11/bot_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1722101942061601052
20231106 TrustPad - Lack of msg.sender address verification
Lost: ~$155K
Test
forge test --contracts ./src/test/2023-11/TrustPad_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1721800306101793188
20231106 KR - Precision loss
Lost: ~$15K
Test
forge test --contracts ./src/test/2023-11/KR_exp.sol -vvv
Contract
Link Reference
20231106 TheStandard_io - Lack of slippage protection
Lost: ~$290K
Test
forge test --contracts ./src/test/2023-11/TheStandard_io_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1721807569222549518
https://twitter.com/CertiKAlert/status/1721839125836321195
20231102 BRAND - Lack of access control
Lost: ~23 WBNB
Test
forge test --contracts ./src/test/2023-11/BRAND_exp.sol -vvv
Contract
Link Reference
https://x.com/MetaSec_xyz/status/1720035913009709473
20231102 3913Token - Deflationary Token Attack
Lost: ~$31354 USD$
Test
forge test --contracts ./src/test/2023-11/3913_exp.sol --evm-version 'shanghai' -vvv
Contract
Link Reference
https://defimon.xyz/attack/bsc/0x8163738d6610ca32f048ee9d30f4aa1ffdb3ca1eddf95c0eba086c3e936199ed
20231101 OnyxProtocol - Precission Loss Vulnerability
Lost: ~$2M
Test
forge test --contracts ./src/test/2023-11/OnyxProtocol_exp.sol --evm-version 'shanghai' -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1719697319824851051 https://defimon.xyz/attack/mainnet/0xf7c21600452939a81b599017ee24ee0dfd92aaaccd0a55d02819a7658a6ef635 https://twitter.com/DecurityHQ/status/1719657969925677161
20231101 SwampFinance - Business Logic Flaw
Lost: Unclear
Test
forge test --contracts ./src/test/2023-11/SwampFinance_exp.sol -vvv
Contract
Link Reference
https://x.com/MetaSec_xyz/status/1720373044517208261
20231031 UniBotRouter - Arbitrary External Call
Lost: ~$83,944 USD$
Test
forge test --contracts ./src/test/2023-10/UniBot_exp.sol --evm-version 'shanghai' -vvv
Contract
Link Reference
https://twitter.com/PeckShieldAlert/status/1719251390319796477
20231030 LaEeb - Lack Slippage Protection
Lost: ~1.8 WBNB
Test
forge test --contracts ./src/test/2023-10/LaEeb_exp.sol -vvv
Contract
Link Reference
https://x.com/MetaSec_xyz/status/1718964562165420076
20231028 AstridProtocol - Business Logic Flaw
Lost: ~$127ETH
Test
forge test --contracts ./src/test/2023-10/Astrid_exp.sol --evm-version 'shanghai' -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1718454835966775325
20231024 MaestroRouter2 - Arbitrary External Call
Lost: ~$280ETH
Test
forge test --contracts ./src/test/2023-10/MaestroRouter2_exp.sol --evm-version 'shanghai' -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1717014871836098663
https://twitter.com/BeosinAlert/status/1717013965203804457
20231022 OpenLeverage - Business Logic Flaw
Lost: ~$8K
Test
forge test --contracts ./src/test/2023-10/OpenLeverage_exp.sol -vvv
Contract
Link Reference
https://defimon.xyz/exploit/bsc/0x5366c6ba729d9cf8d472500afc1a2976ac2fe9ff
20231019 kTAF - CompoundV2 Inflation Attack
Lost: ~$8K
Test
forge test --contracts ./src/test/2023-10/kTAF_exp.sol -vvv
Contract
Link Reference
20231018 Hopelend - Div Precision Loss
Lost: ~$825K
Test
forge test --contracts ./src/test/2023-10/Hopelend_exp.sol --evm-version 'shanghai' -vvv
Contract
Link Reference
https://twitter.com/immunefi/status/1722810650387517715
https://lunaray.medium.com/deep-dive-into-hopelend-hack-5962e8b55d3f
20231018 MicDao - Price Manipulation
Lost: ~$13K
Test
forge test --contracts ./src/test/2023-10/MicDao_exp.sol -vvv
Contract
Link Reference
https://twitter.com/CertiKAlert/status/1714677875427684544
https://twitter.com/ChainAegis/status/1714837519488205276
20231013 BelugaDex - Price manipulation
Lost: ~$175K
Test
forge test --contracts ./src/test/2023-10/BelugaDex_exp.sol -vvv
Contract
Link Reference
https://twitter.com/AnciliaInc/status/1712676040471105870
https://twitter.com/CertiKAlert/status/1712707006979613097
20231013 WiseLending - Donate Inflation ExchangeRate && Rounding Error
Lost: ~$260K
Test
forge test --contracts ./src/test/2023-10/WiseLending_exp.sol --evm-version 'shanghai' -vvv
Contract
Link Reference
https://twitter.com/bbbb/status/1712841315522638034
https://twitter.com/BlockSecTeam/status/1712871304993689709
20231012 Platypus - Business Logic Flaw
Lost: ~$2M
Test
forge test --contracts ./src/test/2023-10/Platypus03_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1712445197538468298
https://twitter.com/peckshield/status/1712354198246035562
20231011 BH - Price manipulation
Lost: ~$1.27M
Test
forge test --contracts ./src/test/2023-10/BH_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1712139760813375973
https://twitter.com/DecurityHQ/status/1712118881425203350
20231008 ZS - Business Logic Flaw
Lost: ~$14K
Test
forge test --contracts ./src/test/2023-10/ZS_exp.sol -vvv
Contract
Link Reference
https://x.com/MetaSec_xyz/status/1711189697534513327
20231008 pSeudoEth - Pool manipulation
Lost: ~$2.3K
Test
forge test --contracts ./src/test/2023-10/pSeudoEth_exp.sol -vvv
Contract
Link Reference
https://twitter.com/CertiKAlert/status/1710979615164944729
20231007 StarsArena - Reentrancy
Lost: ~$3M
Test
forge test --contracts ./src/test/2023-10/StarsArena_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1710556926986342911
https://twitter.com/Phalcon_xyz/status/1710554341466395065
https://twitter.com/peckshield/status/1710555944269292009
20231005 DePayRouter - Business Logic Flaw
Lost: ~$ 827 USDC
Test
forge test --contracts ./src/test/2023-10/DePayRouter_exp.sol -vvv
Contract
Link Reference
https://twitter.com/CertiKAlert/status/1709764146324009268
20230930 FireBirdPair - Lack Slippage Protection
Lost: ~$3.2K MATIC
Test
forge test --contracts ./src/test/2023-09/FireBirdPair_exp.sol -vvv
Contract
Link Reference
20230929 DEXRouter - Arbitrary External Call
Lost: ~$4K
Test
forge test --contracts ./src/test/2023-09/DEXRouter_exp.sol -vvv
Contract
Link Reference
https://twitter.com/DecurityHQ/status/1707851321909428688
20230926 XSDWETHpool - Reentrancy
Lost: ~$56.9BNB
Test
forge test --contracts ./src/test/2023-09/XSDWETHpool_exp.sol -vvv
Contract
Link Reference
https://twitter.com/CertiKAlert/status/1706765042916450781
20230924 KubSplit - Pool manipulation
Lost: ~$78K
Test
forge test --contracts ./src/test/2023-09/Kub_Split_exp.sol -vvv
Contract
Link Reference
https://twitter.com/CertiKAlert/status/1705966214319612092
20230921 CEXISWAP - Incorrect Access Control
Lost: ~$30K
Test
forge test --contracts ./src/test/2023-09/CEXISWAP_exp.sol -vvv
Contract
Link Reference
https://twitter.com/DecurityHQ/status/1704759560614126030
20230916 uniclyNFT - Reentrancy
Lost: 1 NFT
Test
forge test --contracts ./src/test/2023-09/uniclyNFT_exp.sol -vvv
Contract
Link Reference
https://twitter.com/DecurityHQ/status/1703096116047421863
20230911 0x0DEX - Parameter manipulation
Lost: ~$61K
Test
forge test --contracts ./src/test/2023-09/0x0DEX_exp.sol -vvv
Contract
Link Reference
https://0x0ai.notion.site/0x0ai/0x0-Privacy-DEX-Exploit-25373263928b4f18b31c438b2a040e33
20230909 BFCToken - Business Logic Flaw
Lost: ~$38K
Test
forge test --contracts ./src/test/2023-09/BFCToken_exp.sol -vvv
Contract
Link Reference
https://twitter.com/CertiKAlert/status/1700621314246017133
20230908 APIG - Business Logic Flaw
Lost: ~$169K
Test
forge test --contracts ./src/test/2023-09/APIG_exp.sol -vvv
Contract
Link Reference
https://twitter.com/CertiKAlert/status/1700128158647734745
20230907 HCT - Price Manipulation
Lost: ~$30.5BNB
Test
forge test --contracts ./src/test/2023-09/HCT_exp.sol -vvv
Contract
Link Reference
https://twitter.com/leovctech/status/1699775506785198499
20230905 QuantumWN - Rebasing logic issue
Lost: ~$0.5 ETH
Test
forge test --contracts ./src/test/2023-09/QuantumWN_exp.sol -vvv
Contract
Link Reference
https://twitter.com/DecurityHQ/status/1699384904218202618
20230905 JumpFarm - Rebasing logic issue
Lost: ~$2.4ETH
Test
forge test --contracts ./src/test/2023-09/JumpFarm_exp.sol -vvv
Contract
Link Reference
https://twitter.com/DecurityHQ/status/1699384904218202618
20230905 HeavensGate - Rebasing logic issue
Lost: ~$8ETH
Test
forge test --contracts ./src/test/2023-09/HeavensGate_exp.sol -vvv
Contract
Link Reference
20230905 FloorDAO - Rebasing logic issue
Lost: ~$40ETH
Test
forge test --contracts ./src/test/2023-09/FloorDAO_exp.sol -vvv
Contract
Link Reference
https://twitter.com/PeckShieldAlert/status/1698962105058361392
https://medium.com/floordao/floor-post-mortem-incident-summary-september-5-2023-e054a2d5afa4
20230902 DAppSocial - Business Logic Flaw
Lost: ~$16K
Test
forge test --contracts ./src/test/2023-09/DAppSocial_exp.sol -vvv
Contract
Link Reference
https://twitter.com/DecurityHQ/status/1698064511230464310
20230829 EAC - Price Manipulation
Lost: ~$29BNB
Test
forge test --contracts ./src/test/2023-08/EAC_exp.sol -vvv
Contract
Link Reference
https://twitter.com/bbbb/status/1696520866564350157
20230827 Balancer - Rounding Error && Business Logic Flaw
Lost: ~$2M
Test
forge test --contracts ./src/test/2023-08/Balancer_exp.sol -vvv
Contract
Link Reference
20230826 SVT - flawed price calculation
Lost: ~$400K
Test
forge test --contracts ./src/test/2023-08/SVT_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1695285435671392504?s=20
20230824 GSS - skim token balance
Lost: ~$25K
Test
forge test --contracts ./src/test/2023-08/GSS_exp.sol -vvv
Contract
Link Reference
https://twitter.com/bbbb/status/1694571228185723099
20230821 EHIVE - Business Logic Flaw
Lost: ~$15K
Test
forge test --contracts ./src/test/2023-08/EHIVE_exp.sol -vvv
Contract
Link Reference
https://twitter.com/bulu4477/status/1693636187485872583
20230819 BTC20 - Price Manipulation
Lost: ~$18ETH
Test
forge test --contracts ./src/test/2023-08/BTC20_exp.sol -vvv
Contract
Link Reference
https://twitter.com/DecurityHQ/status/1692924369662513472
20230818 ExactlyProtocol - insufficient validation
Lost: ~$7M
Test
forge test --contracts ./src/test/2023-08/Exactly_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1692533280971936059
https://medium.com/@exactly_protocol/exactly-protocol-incident-post-mortem-b4293d97e3ed
20230814 ZunamiProtocol - Price Manipulation
Lost: ~$2M
Test
forge test --contracts ./src/test/2023-08/Zunami_exp.sol --evm-version 'shanghai' -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1690877589005778945
https://twitter.com/BlockSecTeam/status/1690931111776358400
20230809 EarningFram - Reentrancy
Lost: ~$286k
Test
forge test --contracts ./src/test/2023-08/EarningFram_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1689182459269644288
20230802 CurveBurner - Lack Slippage Protection
Lost: ~$36K
Test
forge test --contracts ./src/test/2023-08/CurveBurner_exp.sol -vvv
Contract
Link Reference
20230802 Uwerx - Fault logic
Lost: ~$176ETH
Test
forge test --contracts ./src/test/2023-08/Uwerx_exp.sol -vvv
Contract
Link Reference
https://twitter.com/deeberiroz/status/1686683788795846657
https://twitter.com/CertiKAlert/status/1686667720920625152
https://etherscan.io/tx/0x3b19e152943f31fe0830b67315ddc89be9a066dc89174256e17bc8c2d35b5af8
20230801 NeutraFinance - Price Manipulation
Lost: ~$23ETH
Test
forge test --contracts ./src/test/2023-08/NeutraFinance_exp.sol -vvv
Contract
Link Reference
https://twitter.com/phalcon_xyz/status/1686654241111429120
20230801 LeetSwap - Access Control
Lost: ~$630K
Test
forge test --contracts ./src/test/2023-08/Leetswap_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1686217464051539968
https://twitter.com/peckshield/status/1686209024587710464
20230731 GYMNET - Insufficient validation
Lost: Unclear
Test
forge test --contracts ./src/test/2023-07/GYMNET_exp.sol -vvv
Contract
Link Reference
https://twitter.com/AnciliaInc/status/1686605510655811584
20230730 Curve - Vyper Compiler Bug && Reentrancy
Lost: ~ $41M
Test
forge test --contracts ./src/test/2023-07/Curve_exp01.sol -vvv
Contract
Curve_exp01.sol | Curve_exp02.sol
Link Reference
https://hackmd.io/@LlamaRisk/BJzSKHNjn
20230726 Carson - Price manipulation
Lost: ~$150K
Test
forge test --contracts ./src/test/2023-07/Carson_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1684393202252402688
https://twitter.com/Phalcon_xyz/status/1684503154023448583
https://twitter.com/hexagate_/status/1684475526663004160
20230724 Palmswap - Business Logic Flaw
Lost: ~$900K
Test
forge test --contracts ./src/test/2023-07/Palmswap_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1683680026766737408
20230723 MintoFinance - Signature Replay
Lost: ~$9K
Test
forge test --contracts ./src/test/2023-07/MintoFinance_exp.sol -vvv
Contract
Link Reference
https://twitter.com/bbbb/status/1683180340548890631
20230722 Conic Finance 02 - Price Manipulation
Lost: ~$934K
Test
forge test --contracts ./src/test/2023-07/Conic02_exp.sol --evm-version 'shanghai' -vvv
Contract
Link Reference
https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d
https://twitter.com/spreekaway/status/1682467603518726144
20230721 Conic Finance - Read-Only-Reentrancy && MisConfiguration
Lost: ~$3.25M
Testing
forge test --contracts ./src/test/2023-07/Conic_exp.sol -vvv
Contract
Link Reference
https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d
https://twitter.com/BlockSecTeam/status/1682356244299010049
20230721 SUT - Business Logic Flaw
Lost: ~$8k
Testing
forge test --contracts ./src/test/2023-07/SUT_exp.sol -vvv
Contract
Link Reference
https://twitter.com/bulu4477/status/1682983956080377857
20230720 Utopia - Business Logic Flaw
Lost: ~$119k
Testing
forge test --contracts ./src/test/2023-07/Utopia_exp.sol -vvv
Contract
Link Reference
https://twitter.com/DeDotFiSecurity/status/1681923729645871104
https://twitter.com/bulu4477/status/1682380542564769793
20230720 FFIST - Business Logic Flaw
Lost: ~$110k
Testing
forge test --contracts ./src/test/2023-07/FFIST_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1681869807698984961
https://twitter.com/AnciliaInc/status/1681901107940065280
20230718 APEDAO - Business Logic Flaw
Lost: ~$7K
Testing
forge test --contracts ./src/test/2023-07/ApeDAO_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1681316257034035201
20230718 BNO - Invalid emergency withdraw mechanism
Lost: ~$505K
Testing
forge test --contracts ./src/test/2023-07/BNO_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1681116206663876610
20230717 NewFi - Lack Slippage Protection
Lost: ~$31K
Testing
forge test --contracts ./src/test/2023-07/NewFi_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1680961588323557376
20230715 USDTStakingContract28 - Lack of access control
Lost: ~20999 USD
Testing
forge test --contracts ./src/test/2023-07/USDTStakingContract28_exp.sol -vvv
Contract
Link Reference
https://x.com/DecurityHQ/status/1680117291013267456
20230712 Platypus - Bussiness Logic Flaw
Lost: ~$51K
Testing
forge test --contracts ./src/test/2023-07/Platypus02_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1678800450303164431
20230712 WGPT - Business Logic Flaw
Lost: ~$80k
Testing
forge test --contracts ./src/test/2023-07/WGPT_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1679042549946933248
https://twitter.com/BeosinAlert/status/1679028240982368261
20230711 RodeoFinance - TWAP Oracle Manipulation
Lost: ~$888k
Testing
forge test --contracts ./src/test/2023-07/RodeoFinance_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1678765773396008967
https://twitter.com/peckshield/status/1678700465587130368
https://medium.com/@Rodeo_Finance/rodeo-post-mortem-overview-f35635c14101
20230711 Libertify - Reentrancy
Lost: ~$452k
Testing
forge test --contracts ./src/test/2023-07/Libertify_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1678688731908411393
https://twitter.com/Phalcon_xyz/status/1678694679767031809
20230710 ArcadiaFi - Reentrancy
Lost: ~$400k
Testing
forge test --contracts ./src/test/2023-07/ArcadiaFi_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1678250590709899264
https://twitter.com/peckshield/status/1678265212770693121
20230708 CIVNFT - Lack of access control
Lost: ~$180k
Testing
forge test --contracts ./src/test/2023-07/CIVNFT_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1677722208893022210
https://news.civfund.org/civtrade-hack-analysis-9a2398a6bc2e
https://blog.solidityscan.com/civnft-hack-analysis-4ee79b8c33d1
20230708 Civfund - Lack of access control
Lost: ~$165k
Testing
forge test --contracts ./src/test/2023-07/Civfund_exp.sol -vvv
Contract
Link Reference
https://twitter.com/HypernativeLabs/status/1677529544062803969
https://twitter.com/BeosinAlert/status/1677548773269213184
20230707 LUSD - Price manipulation attack
Lost: ~9464USDT
Testing
forge test --contracts ./src/test/2023-07/LUSD_exp.sol -vvv
Contract
Link Reference
https://twitter.com/AnciliaInc/status/1677391242878140417
20230704 BambooIA - Price manipulation attack
Lost: ~200BNB
Testing
forge test --contracts ./src/test/2023-07/Bamboo_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1676220090142916611
https://twitter.com/eugenioclrc
20230704 BaoCommunity - Donate Inflation ExchangeRate && Rounding Error
Lost: ~$46k
Testing
forge test --contracts ./src/test/2023-07/bao_exp.sol -vvv
Contract
Link Reference
https://twitter.com/PeckShieldAlert/status/1676224397248454657
20230703 AzukiDAO - Invalid signature verification
Lost: ~$69k
Testing
forge test --contracts ./src/test/2023-07/AzukiDAO_exp.sol -vvv
Contract
Link Reference
https://twitter.com/sharkteamorg/status/1676892088930271232
20230630 Biswap - V3Migrator Exploit
Lost: ~$72k
Testing
forge test --contracts ./src/test/2023-06/Biswap_exp.sol -vvv
Contract
Link Reference
https://twitter.com/MetaTrustAlert/status/1674814217122349056?s=20
20230630 MyAi - Business Logic
Lost: ~2 $BNB
Testing
forge test --contracts ./src/test/2023-06/MyAi_exp.sol -vvv
Contract
Link Reference
https://x.com/DecurityHQ/status/1674781372182048776
20230628 Themis - Manipulation of prices using Flashloan
Lost: ~$370k
Testing
forge test --contracts ./src/test/2023-06/Themis_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1673930979348717570
https://twitter.com/BlockSecTeam/status/1673897088617426946
20230627 UnverifiedContr_9ad32 - Business Logic Flaw
Lost: ~5955 USD
Testing
forge test --contracts ./src/test/2023-06/UnverifiedContr_9ad32_exp.sol -vvv
Contract
Link Reference
https://x.com/DecurityHQ/status/1673708133926031360
20230627 STRAC - Business Logic Flaw
Lost: ~12 $ETH
Testing
forge test --contracts ./src/test/2023-06/STRAC_exp.sol -vvv
Contract
Link Reference
https://x.com/DecurityHQ/status/1673769624611987487
20230623 SHIDO - Business Logic
Lost: ~997 WBNB
Testing
forge test --contracts ./src/test/2023-06/SHIDO_exp.sol -vvv
Contract
SHIDO_exp.sol | SHIDO_exp2.sol
Link Reference
https://twitter.com/Phalcon_xyz/status/1672473343734480896
https://twitter.com/AnciliaInc/status/1672382613473083393
20230621 BabyDogeCoin02 - Lack Slippage Protection
Lost: ~ 441 BNB
Testing
forge test --contracts ./src/test/2023-06/BabyDogeCoin02_exp.sol -vvv
Contract
Link Reference
https://twitter.com/hexagate_/status/1671517819840745475
20230621 BUNN - Reflection tokens
Lost: ~52BNB
Testing
forge test --contracts ./src/test/2023-06/BUNN_exp.sol -vvv
Contract
Link Reference
https://twitter.com/DecurityHQ/status/1671803688996806656
20230620 MIMSpell - Arbitrary External Call Vulnerability
Lost: ~$17k
Testing
forge test --contracts ./src/test/2023-06/MIMSpell_exp.sol -vvv
Contract
Link Reference
https://twitter.com/hexagate_/status/1671188024607100928?cxt=HHwWgMC--e2poLEuAAAA
20230619 Contract_0x7657 - Business Logic
Lost: ~$20k $USDT
Testing
forge test --contracts ./src/test/2023-06/Contract_0x7657_exp.sol -vvv
Contract
Link Reference
https://x.com/DecurityHQ/status/1670806260550184962
20230618 ARA - Incorrect handling of permissions
Lost: ~$125k
Testing
forge test --contracts ./src/test/2023-06/ARA_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1670638160550965248
20230617 Pawnfi - Business Logic Flaw
Lost: ~$820K
Testing
forge test --contracts ./src/test/2023-06/Pawnfi_exp.sol -vvv
Contract
Link Reference
https://blog.solidityscan.com/pawnfi-hack-analysis-38ac9160cbb4
20230617 MidasCapitalXYZ - Precision Loss
Lost: ~$600K
Testing
forge test --contracts ./src/test/2023-06/MidasCapitalXYZ_exp.sol -vvv
Contract
Link Reference
https://medium.com/midas-capital/midas-exploit-post-mortem-1ae266222994
20230615 CFC - Uniswap Skim() token balance attack
Lost: ~$16k
Testing
forge test --contracts ./src/test/2023-06/CFC_exp.sol -vvv
Contract
Link Reference
https://twitter.com/hexagate_/status/1669280632738906113
20230615 DEPUSDT_LEVUSDC - Incorrect access control
Lost: ~$105k
Testing
forge test --contracts ./src/test/2023-06/DEPUSDT_LEVUSDC_exp.sol -vvv
Contract
Link Reference
https://twitter.com/numencyber/status/1669278694744150016?cxt=HHwWgMDS9Z2IvKouAAAA
20230612 Sturdy Finance - Read-Only-Reentrancy
Lost: ~$800k
Testing
forge test --contracts ./src/test/2023-06/Sturdy_exp.sol -vvv
contract
Link Reference
https://sturdyfinance.medium.com/exploit-post-mortem-49261493307a
https://twitter.com/AnciliaInc/status/1668081008615325698
https://twitter.com/BlockSecTeam/status/1668084629654638592
20230611 SellToken04 - Price Manipulation
Lost: ~$109k
Testing
forge test --contracts ./src/test/2023-06/SELLC03_exp.sol -vvv
Contract
Link Reference
https://twitter.com/EoceneSecurity/status/1668468933723328513
20230607 CompounderFinance - Manipulation of funds through fluctuations in the amount of exchangeable assets
Lost: ~$27,174
Testing
forge test --contracts ./src/test/2023-06/CompounderFinance_exp.sol -vvv
Contract
Link Reference
https://twitter.com/numencyber/status/1666346419702362112
20230606 VINU - Price Manipulation
Lost: ~$6k
Testing
forge test --contracts ./src/test/2023-06/VINU_exp.sol -vvv
Contract
Link Reference
https://twitter.com/hexagate_/status/1666051854386511873?cxt=HHwWgoC24bPVgJ8uAAAA
20230606 UN - Price Manipulation
Lost: ~$26k
Testing
forge test --contracts ./src/test/2023-06/UN_exp.sol -vvv
Contract
Link Reference
https://twitter.com/MetaTrustAlert/status/1667041877428932608
20230602 NST Simple Swap - Unverified contract, wrong approval
Lost: $40k
The hack was executed in a single transaction, resulting in the theft of $40,000 USD worth of USDT from the swap contract.
forge test --contracts ./src/test/2023-06/NST_exp.sol -vvv
Contract
Link reference
https://discord.com/channels/1100129537603407972/1100129538056396870/1114142216923926528
20230601 DDCoin - Flashloan attack and smart contract vulnerability
Lost: ~$300k
Testing
forge test --contracts ./src/test/2023-06/DDCoin_exp.sol -vvv
Contract
Link Reference
https://twitter.com/ImmuneBytes/status/1664239580210495489 https://twitter.com/ChainAegis/status/1664192344726581255?cxt=HHwWjsDRldmHs5guAAAA
20230601 Cellframenet - Calculation issues during liquidity migration
Lost: ~$76k
Testing
forge test --contracts ./src/test/2023-06/Cellframe_exp.sol -vvv
Contract
Link Reference
https://twitter.com/numencyber/status/1664132985883615235?cxt=HHwWhoDTqceImJguAAAA
20230531 ERC20TokenBank - Price Manipulation
Lost: ~$111k
Testing
forge test --contracts ./src/test/2023-05/ERC20TokenBank_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1663810037788311561
20230529 Jimbo - Protocol Specific Price Manipulation
Lost: ~$8M
Testing
forge test --contracts ./src/test/2023-05/Jimbo_exp.sol -vvv
Contract
Link Reference
https://twitter.com/cryptofishx/status/1662888991446941697
https://twitter.com/yicunhui2/status/1663793958781353985
20230529 BabyDogeCoin - Lack Slippage Protection
Lost: ~$135k
Testing
forge test --contracts ./src/test/2023-05/BabyDogeCoin_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1662744426475831298
20230529 FAPEN - Wrong balance check
Lost: ~$600
Testing
forge test --contracts ./src/test/2023-05/FAPEN_exp.sol -vvv
Contract
Link Reference
https://twitter.com/hexagate_/status/1663501550600302601
20230529 NOON (NO) - Wrong visibility in function
Lost: ~$2K
Testing
forge test --contracts ./src/test/2023-05/NOON_exp.sol -vvv
Contract
Link Reference
https://twitter.com/hexagate_/status/1663501545105702912
20230525 GPT Token - Fee Machenism Exploitation
Lost: ~$42k
Testing
forge test --contracts ./src/test/2023-05/GPT_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1661424685320634368
20230524 Local Trade LCT - Improper Access Control of Close-source contract
Lost: ~384 BNB
Testing
forge test --contracts ./src/test/2023-05/LocalTrader_exp.sol -vvv
Contract
LocalTrader_exp.sol | LocalTrader2_exp.sol
Link Reference
https://twitter.com/numencyber/status/1661213691893944320
20230524 CS Token - Outdated Global Variable
Lost: ~714K USD
Testing
forge test --contracts ./src/test/2023-05/CS_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1661098394130198528
https://twitter.com/numencyber/status/1661207123102167041
20230523 LFI Token - Business Logic Flaw
Lost: ~36K USD
Testing
forge test --contracts ./src/test/2023-05/LFI_exp.sol -vvv
Contract
Link Reference
https://twitter.com/AnciliaInc/status/1660767088699666433
20230514 landNFT - Lack of permission control
Lost: 149,616 $BUSD
Testing
forge test --contracts ./src/test/2023-05/landNFT_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1658000784943124480
20230514 SellToken03 - Unchecked User Input
Lost: Unclear
Testing
forge test --contracts ./src/test/2023-05/SELLC02_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1657715018908180480
20230513 Bitpaidio - Business Logic Flaw
Lost: ~$30K
Testing
forge test --contracts ./src/test/2023-05/Bitpaidio_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1657411284076478465
20230512 LW - FlashLoan Price Manipulation
Lost: ~$50k
Testing
forge test --contracts ./src/test/2023-05/LW_exp.sol -vvv
Contract
Link Reference
https://twitter.com/PeckShieldAlert/status/1656850634312925184
https://twitter.com/hexagate_/status/1657051084131639296
20230513 SellToken02 - Price Manipulation
Lost: ~$197k
Testing
forge test --contracts ./src/test/2023-05/SellToken_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1657324561577435136
20230511 SellToken01 - Business Logic Flaw
Lost: ~$95k
Testing
forge test --contracts ./src/test/2023-05/SELLC_exp.sol -vvv
Contract
Link Reference
https://twitter.com/AnciliaInc/status/1656337400329834496
https://twitter.com/AnciliaInc/status/1656341587054702598
20230510 SNK - Reward Calculation Error
Lost: ~$197k
Testing
forge test --contracts ./src/test/2023-05/SNK_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1656176776425644032
20230509 MCC - Reflection token
Lost: ~$10 ETH
Testing
forge test --contracts ./src/test/2023-05/MultiChainCapital_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1655846558762692608
20230509 HODL - Reflection token
Lost: ~$2.3 ETH
Testing
forge test --contracts ./src/test/2023-05/HODLCapital_exp.sol -vvv
Contract
Link Reference
https://x.com/numencyber/status/1655825767392247808
20230506 Melo - Access Control
Lost: ~$90k
Testing
forge test --contracts ./src/test/2023-05/Melo_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1654667621139349505
20230505 DEI - wrong implemention
Lost: ~5.4M USDC
Testing
forge test --contracts ./src/test/2023-05/DEI_exp.sol -vvv
Contract
Link Reference
https://twitter.com/eugenioclrc/status/1654576296507088906
20230503 NeverFall - Price Manipulation
Lost: ~74K
Testing
forge test --contracts ./src/test/2023-05/NeverFall_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1653619782317662211
20230502 Level - Business Logic Flaw
Lost: ~$1M
Testing
forge test --contracts ./src/test/2023-05/Level_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1653149493133729794
https://twitter.com/BlockSecTeam/status/1653267431127920641
20230428 0vix - FlashLoan Price Manipulation
Lost: ~$2M
Testing
forge test --contracts ./src/test/2023-04/0vix_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1651932529874853888
https://twitter.com/peckshield/status/1651923235603361793
https://twitter.com/Mudit__Gupta/status/1651958883634536448
20230427 Silo finance - Business Logic Flaw
Lost: None
Testing
forge test --contracts ./src/test/2023-04/silo_finance_exp.sol -vvv
Contract
Link Reference
https://medium.com/immunefi/silo-finance-logic-error-bugfix-review-35de29bd934a
20230424 Axioma - Business Logic Flaw
Lost: ~21 WBNB
Testing
forge test --contracts ./src/test/2023-04/Axioma_exp.sol -vvv
Contract
Link Reference
https://twitter.com/HypernativeLabs/status/1650382589847302145
20230419 OLIFE - Reflection token
Lost: ~32 WBNB
Testing
forge test --contracts ./src/test/2023-04/OLIFE_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1648520494516420608
20230416 Swapos V2 - error k value Attack
Lost: ~$468k
Testing
forge test --contracts ./src/test/2023-04/Swapos_exp.sol -vvv
Contract
Link Reference
https://twitter.com/CertiKAlert/status/1647530789947469825
https://twitter.com/BeosinAlert/status/1647552192243728385
20230415 HundredFinance - Donate Inflation ExchangeRate && Rounding Error
Lost: $7M
Testing
forge test --contracts ./src/test/2023-04/HundredFinance_2_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1647307128267476992
https://twitter.com/danielvf/status/1647329491788677121
https://twitter.com/hexagate_/status/1647334970258608131
https://blog.hundred.finance/15-04-23-hundred-finance-hack-post-mortem-d895b618cf33
20230413 yearnFinance - Misconfiguration
Lost: $11.6M
Testing
forge test --contracts ./src/test/2023-04/YearnFinance_exp.sol -vvv
Contract
Link Reference
https://twitter.com/cmichelio/status/1646422861219807233
https://twitter.com/BeosinAlert/status/1646481687445114881
20230412 MetaPoint - Unrestricted Approval
Lost: $820k(2500BNB)
Testing
forge test --contracts ./src/test/2023-04/MetaPoint_exp.sol -vvv
Contract
Link Reference
https://twitter.com/PeckShieldAlert/status/1645980197987192833
https://twitter.com/Phalcon_xyz/status/1645963327502204929
20230411 Paribus - Reentrancy
Lost: $100k
Testing
forge test --contracts ./src/test/2023-04/Paribus_exp.sol -vvv
Contract
Link Reference
https://twitter.com/Phalcon_xyz/status/1645742620897955842
https://twitter.com/BlockSecTeam/status/1645744655357575170
https://twitter.com/peckshield/status/1645742296904929280
20230409 SushiSwap - Unchecked User Input
Lost: >$3.3M
Testing
forge test --contracts ./src/test/2023-04/Sushi_Router_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1644907207530774530
https://twitter.com/SlowMist_Team/status/1644936375924584449
https://twitter.com/AnciliaInc/status/1644925421006520320
20230405 Sentiment - Read-Only-Reentrancy
Lost: $1M
Testing
forge test --contracts ./src/test/2023-04/Sentiment_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1643417467879059456
https://twitter.com/spreekaway/status/1643313471180644360
20230402 Allbridge - FlashLoan price manipulation
Lost: $550k
Testing
forge test --contracts ./src/test/2023-04/Allbridge_exp.sol -vvv
Contract
Allbrideg_exp.sol | Allbrideg_exp2.sol
Link Reference
https://twitter.com/peckshield/status/1642356701100916736
https://twitter.com/BeosinAlert/status/1642372700726505473
20230328 SafeMoon Hack - Access Control
Lost: $8.9M
Testing
forge test --contracts ./src/test/2023-03/safeMoon_exp.sol -vvv
Contract
Link reference
https://twitter.com/zokyo_io/status/1641014520041840640
20230328 - Thena - Yield Protocol Flaw
Lost: $10k
Testing
forge test --contracts ./src/test/2023-03/Thena_exp.sol -vvv
Contract
Link Reference
https://twitter.com/LTV888/status/1640563457094451214?t=OBHfonYm9yYKvMros6Uw_g&s=19
20230325 - DBW - Business Logic Flaw
Lost: $24k
Testing
forge test --contracts ./src/test/2023-03/DBW_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BeosinAlert/status/1639655134232969216
https://twitter.com/AnciliaInc/status/1639289686937210880
20230322 - BIGFI - Reflection token
Lost: $30k
Testing
forge test --contracts ./src/test/2023-03/BIGFI_exp.sol -vvv
Contract
Link Reference
https://twitter.com/HypernativeLabs/status/1638522680654675970
20230317 - ParaSpace NFT - Flashloan + scaledBalanceOf Manipulation
Rescued: ~2,909 ETH
Testing
forge test --contracts ./src/test/2023-03/paraspace_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1636650252844294144
20230315 - Poolz - integer overflow
Lost: ~$390K
Testing
forge test --contracts ./src/test/2023-03/poolz_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1635860470359015425
20230313 - EulerFinance - Business Logic Flaw
Lost: ~$200M
Testing
forge test --contracts ./src/test/2023-03/Euler_exp.sol -vvv
Contract
Link Reference
https://twitter.com/FrankResearcher/status/1635241475989721089
https://twitter.com/nomorebear/status/1635230621856600064
https://twitter.com/peckshield/status/1635229594596036608
https://twitter.com/BlockSecTeam/status/1635262150624305153
20230308 - DKP - FlashLoan price manipulation
Lost: ~$80K
Testing
forge test --contracts ./src/test/2023-03/DKP_exp.sol -vvv
Contract
Link Reference
https://twitter.com/CertiKAlert/status/1633421908996763648
20230307 - Phoenix - Access Control & Arbitrary External Call
Lost: ~$100k
Testing
forge test --contracts src/test/2023-03/Phoenix_exp.sol -vvv
Contract
Link Reference
https://twitter.com/HypernativeLabs/status/1633090456157401088
20230227 - LaunchZone - Access Control
Lost: ~$320,000
Testing
forge test --contracts src/test/2023-02/LaunchZone_exp.sol -vvv
Contract
Link Reference
https://twitter.com/immunefi/status/1630210901360951296
https://twitter.com/launchzoneann/status/1631538253424918528
20230227 - swapX - Access Control
Lost: ~$1M
Testing
forge test --contracts ./src/test/2023-02/swapX_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1630111965942018049
https://twitter.com/peckshield/status/1630100506319413250
https://twitter.com/CertiKAlert/status/1630241903839985666
20230224 - EFVault - Storage Collision
Lost: ~$5.1M
Testing
forge test --contracts ./src/test/2023-02/EFVault_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1630490333716029440
https://twitter.com/drdr_zz/status/1630500170373685248
https://twitter.com/gbaleeeee/status/1630587522698080257
20230222 - DYNA - Business Logic Flaw
Lost: ~$21k
Testing
forge test --contracts ./src/test/2023-02/DYNA_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1628319536117153794
https://twitter.com/BeosinAlert/status/1628301635834486784
20230218 - RevertFinance - Arbitrary External Call Vulnerability
Lost: ~$30k
Testing
forge test --contracts ./src/test/2023-02/RevertFinance_exp.sol -vvv
Contract
Link Reference
https://mirror.xyz/revertfinance.eth/3sdpQ3v9vEKiOjaHXUi3TdEfhleAXXlAEWeODrRHJtU
20230217 - Starlink - Business Logic Flaw
Lost: ~$12k
Testing
forge test --contracts ./src/test/2023-02/Starlink_exp.sol -vvv
Contract
Link Reference
https://twitter.com/NumenAlert/status/1626447469361102850
https://twitter.com/bbbb/status/1626392605264351235
20230217 - Dexible - Arbitrary External Call Vulnerability
Lost: ~$1.5M
Testing
forge test --contracts src/test/2023-02/Dexible_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1626493024879673344
https://twitter.com/MevRefund/status/1626450002254958592
20230217 - Platypusdefi - Business Logic Flaw
Lost: ~$8.5M
Testing
forge test --contracts src/test/2023-02/Platypus_exp.sol -vvv
Contract
Link Reference
https://twitter.com/peckshield/status/1626367531480125440
https://twitter.com/spreekaway/status/1626319585040338953
20230210 - Sheep - Reflection token
Lost: ~$3K
Testing
forge test --contracts src/test/2023-02/Sheep_exp.sol -vvv
Contract
Link Reference
https://twitter.com/BlockSecTeam/status/1623999717482045440
https://twitter.com/BlockSecTeam/status/1624077078852210691
20230210 - dForce - Read-Only-Reentrancy
Lost: ~$3.65M
Testing
forge test --contracts ./src/test/2023-02/dForce_exp.sol -vvv
Contract
Link reference
https://twitter.com/SlowMist_Team/status/1623956763598000129
https://twitter.com/BlockSecTeam/status/1623901011680333824
https://twitter.com/peckshield/status/1623910257033617408
20230207 - CowSwap - Arbitrary External Call Vulnerability
Lost: ~$120k
Testing
forge test --contracts ./src/test/2023-02/CowSwap_exp.sol -vvv
Contract
Link reference
https://twitter.com/MevRefund/status/1622793836291407873
https://twitter.com/peckshield/status/1622801412727148544
20230206 - FDP - Reflection token
Lost: ~16 WBNB
Testing
forge test --contracts src/test/2023-02/FDP_exp.sol -vv
Contract
Link reference
https://twitter.com/BeosinAlert/status/1622806011269771266
20230203 - Spherax USDs - Balance Recalculation Bug
Lost: ~309k USDs (Stablecoin)
Testing
forge test --contracts ./src/test/2023-02/USDs_exp.sol -vv
Contract
Link reference
https://twitter.com/danielvf/status/1621965412832350208
https://medium.com/sperax/usds-feb-3-exploit-report-from-engineering-team-9f0fd3cef00c
20230203 - Orion Protocol - Reentrancy
Lost: $3M
Testing
forge test --contracts ./src/test/2023-02/Orion_exp.sol -vvv
Contract
Link reference
https://twitter.com/peckshield/status/1621337925228306433
https://twitter.com/BlockSecTeam/status/1621263393054420992
https://www.numencyber.com/analysis-of-orionprotocol-reentrancy-attack-with-poc/
20230202 - BonqDAO - Price Oracle Manipulation
Lost: BEUR stablecoin and ALBT Token (~88M US$)
Testing
forge test --contracts ./src/test/2023-02/BonqDAO_exp.sol -vv
Contract
Link reference
https://twitter.com/BlockSecTeam/status/1621043757390123008
https://twitter.com/SlowMist_Team/status/1621087651158966274
20230130 - BEVO - Reflection token
Lost: 144 BNB
Testing
forge test --contracts ./src/test/2023-01/BEVO_exp.sol -vvv
Contract
Link reference
https://twitter.com/QuillAudits/status/1620377951836708865
20230126 - TINU - Reflection token
Lost: 22 ETH
Testing
forge test --contracts ./src/test/2023-01/TINU_exp.sol -vv
Contract
Link reference
https://twitter.com/libevm/status/1618718156343873536
20230119 - SHOCO - Reflection token
Lost: ~4ETH
Testing
forge test --contracts ./src/test/2023-01/SHOCO_exp.sol -vvvgit
Contract
Link reference
https://github.com/Autosaida/DeFiHackAnalysis/blob/master/analysis/230119_SHOCO.md
20230119 - ThoreumFinance - business logic flaw
Lost: ~2000 BNB
Testing
forge test --contracts ./src/test/2023-01/ThoreumFinance_exp.sol -vvv
Contract
Link reference
https://bscscan.com/tx/0x3fe3a1883f0ae263a260f7d3e9b462468f4f83c2c88bb89d1dee5d7d24262b51 https://twitter.com/AnciliaInc/status/1615944396134043648
20230118 - QTNToken - business logic flaw
Lost: ~2ETH
Testing
forge test --contracts ./src/test/2023-01/QTN_exp.sol -vvv
Contract
Link reference
https://twitter.com/BlockSecTeam/status/1615625901739511809
20230118 - UPSToken - business logic flaw
Lost: ~22 ETH
Testing
forge test --contracts ./src/test/2023-01/Upswing_exp.sol -vvv
Contract
Link reference
https://etherscan.io/tx/0x4b3df6e9c68ae482c71a02832f7f599ff58ff877ec05fed0abd95b31d2d7d912 https://twitter.com/QuillAudits/status/1615634917802807297
20230117 - OmniEstate - No Input Parameter Check
Lost: $70k(236 BNB)
Testing
forge test --contracts ./src/test/2023-01/OmniEstate_exp.sol -vvv
Contract
Link reference
https://twitter.com/BlockSecTeam/status/1615232012834705408
20230116 - MidasCapital - Read-only Reentrancy
Lost: $650k
Testing
forge test --contracts ./src/test/2023-01/Midas_exp.sol -vvv
Contract
Link reference
https://twitter.com/peckshield/status/1614774855999844352
https://twitter.com/BlockSecTeam/status/1614864084956254209
20230111 - UFDao - Incorrect Parameter Setting
Lost: $90k
Testing
forge test --contracts ./src/test/2023-01/UFDao_exp.sol -vvv
Contract
Link reference
https://twitter.com/BlockSecTeam/status/1613507804412940289
20230111 - RoeFinance - FlashLoan price manipulation
Lost: $80k
Testing
forge test --contracts ./src/test/2023-01/RoeFinance_exp.sol -vvv
Contract
Link reference
https://twitter.com/BlockSecTeam/status/1613267000913960976
20230110 - BRA - Business Logic Flaw
Lost: 819 BNB (~224k$)
Testing
forge test --contracts ./src/test/2023-01/BRA_exp.sol -vvv
Contract
Link reference
https://twitter.com/CertiKAlert/status/1612674916070858753
https://twitter.com/BlockSecTeam/status/1612701106982862849
20230103 - GDS - Business Logic Flaw
Lost: $180k
Testing
forge test --contracts ./src/test/2023-01/GDS_exp.sol -vvv