SunWeb3Sec/DeFiHackLabs

Reproduce DeFi hacked incidents using Foundry.

Solidity

6,808

3,879 commits

updated Oct 12, 2026

See the code

README

DeFi Hacks Reproduce - Foundry

Reproduce DeFi hack incidents using Foundry.

888 incidents included.

Let's make Web3 secure! Join Discord

Notion: 101 root cause analysis of past DeFi hacked incidents

Transaction debugging tools

Disclaimer: This content serves solely as a proof of concept showcasing past DeFi hacking incidents. It is strictly intended for educational purposes and should not be interpreted as encouraging or endorsing any form of illegal activities or actual hacking attempts. The provided information is for informational and learning purposes only, and any actions taken based on this content are solely the responsibility of the individual. The usage of this information should adhere to applicable laws, regulations, and ethical standards.

Getting Started
Who Support Us
Donate Us
List of Past DeFi Incidents
Transaction debugging tools
Ethereum Signature Database
Useful tools
Hacks Dashboard
List of DeFi Hacks & POCs

Getting Started

Follow the instructions to install Foundry.
Clone and install dependencies:git submodule update --init --recursive
Contributing Guidelines

Web3 Cybersecurity Academy

All articles are also published on Substack.

OnChain transaction debugging

Lesson 1: Tools ( English | 中文 | Vietnamese | Korean | Spanish | 日本語 )
Lesson 2: Warm up ( English | 中文 | Korean | Spanish | 日本語 )
Lesson 3: Write Your Own PoC (Price Oracle Manipulation) ( English | 中文 | Korean | Spanish | 日本語 )
Lesson 4: Write Your Own PoC (MEV Bot) ( English | 中文 | Korean | Spanish | 日本語 )
Lesson 5: Rugpull Analysis ( English | 中文 | Spanish | 日本語 )
Lesson 6: Write Your Own PoC (Reentrancy) ( English | 中文 | Spanish | 日本語 )
Lesson 7: Hack Analysis: Nomad Bridge, August 2022 ( English | 中文 | Spanish | 日本語 )

Donate us

If you appreciate our work, please consider donating. Even a small amount helps us continue developing and improving our projects, and promoting web3 security.

Gitcoin - Donate DeFiHackLabs
EVM Chains - 0xD7d6215b4EF4b9B5f40baea48F41047Eb67a11D5
Giveth

List of Past DeFi Incidents

20261006 SetProtocol

20261006 MakerDAOFlipKeeper

20261003 MALT

20261002 GoldPesa

20261001 FlashLoopAdapter

20260930 SKYDAO

20260930 PositionManager

20260930 MUS

20260929 LPBonus

20260926 DAOstack

20260923 PancakeV3SwapHelper

20260921 DoinGud

20260921 GaslessReservoirEnabler

20260921 InternetToken

20260918 Likwid

20260916 Startale

20260916 Flamincome

20260916 PrimeFinance

20260916 Nimiq

20260915 RsETHSafeModule

20260915 BonfireSwap

20260912 SpiralHookV2

20260912 YamFinance

20260911 ORB

20260911 GDC

20260909 EtherFiAtomicQueue

20260909 OMNI404

20260909 UnifiProtocol

20260909 BeatXswap

20260909 EnsoFinance

20260909 ZentraFinance

20260908 OrderFactory

20260903 NotionalFinance

20260901 ReflexerGEB

20260831 FloatProtocol

20260831 BalancerV1BPool

20260828 AjnaFinance

20260827 CashCowCoin

20260826 EnjinCryptoItems

20260819 AllbridgeCCTP

20260809 USM

20260806 UnistreetLaunchpad

20260805 StrongBlock

20260803 AIC

20260802 MOKE

20260716 CrowdRingCircle

20260716 PerpetualProtocol

20260627 CookFinanceIssuance

20260625 LixirPermitDrain

20260625 OceanBPoolSideStaking

20260624 DLMC

20260623 RoyalRoyalties

20260622 Aztec Escape Hatch

20260614 Aztec Connect

20260609 TOPBPool

20260609 NovaBox

20260607 AmbientCrocSwapDex

20260606 BOSS

20260605 DTXT

20260605 AISOTHPresale

20260528 LegendaryMoneyMonNft

20260528 DxSale

20260527 Joe Agent

20260526 SKP Token

20260525 SquidRouterModule

20260525 New Market Trading

20260525 WUSD.fi

20260522 FractalProtocol

20260521 MureDistribution

20260515 AdsharesBridge

20260512 SQTokenStaking

20260511 INKFinance

20260511 HumaFinance

20260510 Renegade

20260507 TrustedVolumes

20260505 Ekubo

20260501 SharwaMarginTrading

20260428 RWAVault

20260428 JUDAO

20260427 Unverified_a152

20260425 SingularityDynaVault

20260423 GiddyVaultV3

20260421 KipseliPropAMM

20260420 JuiceboxREVLoans

20260420 ThetanutsVaultShareRounding

20260419 AaveRebalancerCreditDelegation

20260415 XLootStaking

20260414 MONA LisaVault

20260414 Saturn Protocol

20260412 SubQuerySettings

20260407 SquidMulticallAllowanceDrain

20260405 PerpPair

20260331 WhalebitOracleManipulation

20260328 VTSwapHook

20260327 EST Token

20260324 XocolatlLiquidator

20260324 Univ3CollateralToken

20260302 Curve LlamaLend

2025

20251020 SharwaFinance

20250830 EverValueCoin

20250827 0xf340

20250823 EquilibriaEPendle

20250823 ABCCApp

20250822 Unverified_6f7a

20250820 MulticallWithXera

20250820 0x8d2e

20250819 PresaleV5

20250817 AutoPooledTradingBot

20250816 unverified

20250816 d3xai

20250815 SizeFlashLoanLooping

20250815 PDZ

20250815 SizeCredit

20250813 BeefyZapRouter

20250813 YuliAI

20250813 coinbase

20250813 Grizzifi

20250812 BaseBebopSettlement

20250812 Bebop

20250811 WXC

20250808 ArbitrumBaseSwapper

20250805 MyCoinMaster

20250804 BscInitcodeToken

20250801 PendleReflector

20250729 AnyswapWETHPermit

20250728 SuperRare

20250728 AvaxBIFKNPair

20250726 Unverified670471

20250726 Unverified6883

20250726 MulticallWithETH

20250725 WhereIsMyDragonTreasure

20250724 SWAPPStaking

20250724 EmptySetReserve

20250721 BoJLeverageMarket

20250720 Stepp2p

20250717 unverified

20250717 WETC

20250716 StrategyLlamaLendConvex

20250716 VDS

20250713 UPENG

20250709 GMX

20250705 ActivePoolScrvUsd

20250705 Unverified_54cd

20250705 RANT

20250702 FPC

20250702 ActivePoolUrgentRedemption

20250629 Stead

20250628 InitcodeFactoryFees

20250626 ResupplyFi

20250625 Unverified_b5cb

20250625 SiloFinance

20250625 ParaSwapDAIApproval

20250623 GradientMakerPool

20250620 TokenVault

20250620 HoldSafe

20250620 Gangsterfinance

20250619 SinstakeZombie

20250619 BasePricePool

20250619 BankrollStack

20250619 BankrollNetwork

20250618 BankrollStackPlus

20250617 MetaPool

20250615 WaleCoin

20250615 FixedTokenBSwap

20250614 TSAggregatorGeneric

20250612 AAVEBoost

20250610 unverified_8490

20250609 BitCrown

20250608 TokenFactory

20250603 PegaBall

20250531 DogeAlliance

20250528 Corkprotocol

20250528 Unverified_91a1

20250527 UsualMoney

20250526 YDT

20250525 Unverified_0000

20250509 Nalakuvara_LotteryTicket50

20250427 multitransferswap

20250427 AventaRewardClaim

20250426 Lifeprotocol

20250411 Unverified 0x6077

20250311 ZeroExSettler

20250305 1inch Fusion V1 Settlement

20250304 Pump

20250227 Venus_ZKSync

20250226 HenloKart

20250224 INVISTECH

20250223 HegicOptions

20250222 Unverified_35bc

20250221 StepHeroNFTs

20250221 Bybit

20250215 unverified_d4f1

20250211 Scorch

20250211 LimitOrderProtocol

20250211 FourMeme

20250208 GMT7

20250208 Peapods Finance

20250201 GoldReserve

20250128 MCAI

20250126 AIXBTForcedSwap

20250111 RoulettePotV2

2024

20241120 MainnetSettler

20241119 PolterFinance

20241026 CompoundFork

20241022 Erc20transfer

20240926 Bedrock_DeFi

20240924 MARA

20240923 PestoToken

20240923 Bankroll_Network

20240920 DOGGO

20240920 Shezmu

20240918 Unverified_766a

20240915 WXETA

20240913 Unverified_5697

20240913 OTSeaStaking

20240912 Unverified_03f9

20240911 INUMI

20240911 INUMI_db27

20240911 AIRBTC

20240910 Caterpillar_Coin_CUT

20240905 Unverified_a89f

20240905 PLN

20240905 HANAToken

20240904 Unverified_16d0

20240903 Penpiexyz_io

20240902 Pythia

20240828 Unverified_667d

20240828 AAVE

20240820 COCO

20240816 Zenterest

20240816 OMPxContract

20240724 Spectra_finance

20240723 MEVbot_0xdd7c

20240716 Lifiprotocol

20240703 UnverifiedContr_0x452E25

20240610 UwuLend - Price Manipulation

20240531 Liquiditytokens

20240531 MixedSwapRouter

20240529 SCROLL

20240529 MetaDragon

20240528 Tradeonorion

20240514 Sonne Finance

20240514 PredyFinance

20240419 HedgeyFinance

20240417 UnverifiedContr_0x00C409

20240416 SATX

20240416 MARS_DEFI

20240415 GFA

20240415 ChaingeFinance

20240402 HoppyFrogERC

20240401 ATM

20240401 OpenLeverage

20240228 SMOOFSStaking

20240223 Zoomer

20240223 CompoundUni

20240223 BlueberryProtocol

20240222 SwarmMarkets

20240216 ParticleTrade

20240129 PeapodsFinance

20240128 BarleyFinance

20240127 CitadelFinance

20240125 NBLGAME

20240122 DAO_SoulMate

20240117 BmiZapper

20240117 SocketGateway

20240115 Shell_MEV_0xa898

20240102 RadiantCapital

20240101 OrbitChain

2023

20231231 Channels BUSD&USDC

20231230 ChannelsFinance

20231228 CCV

20231228 DominoTT

20231225 Telcoin

20231222 PineProtocol

20231220 TransitFinance

20231217 Bob

20231217 FloorProtocol

20231211 GoodCompound

20231209 BCT

20231207 HNet

20231206 TIME

20231206 ElephantStatus

20231205 MAMO

20231205 BEARNDAO

20231202 bZxProtocol

20231201 UnverifiedContr_0x431abb

20231130 EEE

20231130 CAROLProtocol

20231117 Token8633_9419

20231106 TheStandard_io

20231106 KR

20231102 BRAND

20231102 3913Token

20231101 SwampFinance

20231101 OnyxProtocol

20231031 UniBotRouter

20231030 LaEeb

20231028 AstridProtocol

20231024 MaestroRouter2

20231022 OpenLeverage

20230930 FireBirdPair

20230818 ExactlyProtocol

20230814 ZunamiProtocol

20230809 EarningFram

20230802 CurveBurner

20230802 Uwerx

20230801 NeutraFinance

20230723 MintoFinance

20230722 ConicFinance02

20230721 ConicFinance

20230715 USDTStakingContract28

20230712 Platypus

20230712 WGPT

20230711 RodeoFinance

20230704 BaoCommunity

20230627 UnverifiedContr_9ad32

20230627 STRAC

20230623 SHIDO

20230621 BabyDogeCoin02

20230621 BUNN

20230620 MIM

20230619 Contract_0x7657

20230618 ARA

20230617 MidasCapitalXYZ

20230617 Pawnfi

20230615 CFC

20230615 DEPUSDT_LEVUSDC

20230612 Sturdy Finance

20230611 SellToken04

20230607 CompounderFinance

20230606 VINU

20230606 UN

20230602 NST SimpleSwap

20230601 DDCoin

20230601 Cellframenet

20230531 ERC20TokenBank

20230529 Jimbo

20230529 BabyDogeCoin

20230415 HundredFinance

20230413 yearnFinance

20230328 SafeMoon Hack

20230328 THENA

20230325 DBW

20230322 BIGFI

20230317 ParaSpace NFT

20230315 Poolz

20230313 EulerFinance

20230218 RevertFinance

20230217 Starlink

20230217 Dexible

20230217 Platypusdefi

20230203 Orion Protocol

20230203 Spherax USDs

20230202 BonqDAO

20230130 BEVO

20230126 TomInu Token

20230119 SHOCO Token

20230119 ThoreumFinance

20230118 QTN Token

20230118 UPS Token

20230117 OmniEstate

20230116 MidasCapital

2022

20221211 MEVbot_0x28d9

20221119 AnnexFinance

20221027 Team Finance

20221026 N00d Token

20221025 ULME

20221024 Market

20221024 MulticallWithoutCheck

20221021 OlympusDAO

20221020 HEALTH Token

20221014 EFLeverVault

20221014 MEVBOT a47b

20221012 ATK

20221011 Rabby Wallet SwapRouter

20221011 Templedao

20221010 Carrot

20221009 Xave Finance

20221006 RES-Token

20221002 Transit Swap

20221001 BabySwap

20221001 RL

20221001 Thunder Brawl

20220929 BXH

20220928 MEVBOT Badc0de

20220923 RADT-DAO

20220913 MevBot Private TX

20220909 DPC

20220908 YYDS

20220908 NewFreeDAO

20220908 Ragnarok Online Invasion

20220906 NXUSD

20220905 ZoomproFinance

20220902 ShadowFi

20220902 Bad Guys by RPF

20220828 DDC

20220824 LuckyTiger NFT

20220816 Circle_2

20220813 Circle

20220810 XSTABLE Protocol

20220802 Nomad Bridge

20220801 Reaper Farm

20220725 LPC

20220723 Audius

20220713 SpaceGodzilla

20220710 Omni NFT

20220706 FlippazOne NFT

20220701 Quixotic - Optimism NFT Marketplace

20220626 XCarnival

20220624 Harmony's Horizon Bridge

20220618 SNOOD

20220616 InverseFinance

20220608 GYMNetwork

20220608 Optimism - Wintermute

20220606 Discover

20220529 NOVO Protocol

20220524 HackDao

20220517 ApeCoin

20220508 Fortress Loans

20220430 Saddle Finance

20220430 Rari Capital/Fei Protocol

20220428 DEUS DAO

20220424 Wiener DOGE

20220423 Akutar NFT

20220421 Zeed Finance

20220416 BeanstalkFarms

20220415 Rikkei Finance

20220412 ElephantMoney

20220411 Creat Future

20220409 GYMNetwork

20220329 Ronin Network

20220329 Redacted Cartel

20220327 Revest Finance

20220326 Auctus

20220322 CompoundTUSDSweepTokenBypass

20220321 OneRing Finance

20220320 LI.FI

20220320 Umbrella Network

20220315 Agave Finance

20220315 Hundred Finance

20220313 Paraluni

20220309 Fantasm Finance

20220305 Bacon Protocol

20220303 TreasureDAO

20220214 BuildFinance - DAO

20220208 Sandbox LAND

20220205 Meter

20220204 TecraSpace

20220128 Qubit Finance

20220118 Multichain (Anyswap)

2021

20211221 Visor Finance

20211218 Grim Finance

20211214 Nerve Bridge

20211130 MonoX Finance

20211123 Ploutoz Finance

20211027 Cream Finance

20211015 Indexed Finance

20210916 SushiSwap Miso

20210915 Nimbus Platform

20210915 NowSwap Platform

20210912 ZABU Finance

20210903 DAO Maker

20210830 Cream Finance

20210817 XSURGE

20210811 Poly Network

20210804 WaultFinance

20210804 Popsicle

20210728 Levyathan Finance

20210710 Chainswap

20210702 Chainswap

20210628 SafeDollar

20210625 xWin Finance

20210622 Eleven Finance

20210607 88mph NFT

20210603 PancakeHunny

20210527 JulSwap

20210527 BurgerSwap

20210519 PancakeBunny

20210516 bEarn

20210508 Rari Capital

20210305 Paid Network

20210204 Yearn YDai

20210125 Sushi Badger Digg

Before 2020

20201229 Cover Protocol

20201121 Pickle Finance

20201026 Harvest Finance

20200912 bzx

20200804 Opyn Protocol

20200628 Balancer Protocol

20200618 Bancor Protocol

20180422 Beauty Chain

20171106 Parity - 'Accidentally Killed It'

20170719 Parity Multisig

Transaction debugging tools

Ethereum Signature Database

4byte | sig db | etherface

Useful tools

ABI to interface | Get ABI for unverified contracts | ETH Calldata Decoder | ETHCMD - Guess ABI | Abi tools

Hacks Dashboard

List of DeFi Hacks & POCs

forge test --contracts src/test/2026-10/SetProtocol_exp.sol --evm-version cancun -vvv

Contract

SetProtocol_exp.sol

20261006 MakerDAOFlipKeeper - the dormant ETH-A flip-keeper proxy's drain selector has no ds-auth check, so anyone can call it to make the keeper vat.hope() a caller-supplied worker and then deal its four undealt 2020 ETH-A auctions and flux/exit the freed 200 WETH of collateral out

Lost: exactly 200 ETH (200.000000000000000000 WETH, 0xad78ebc5ac6200000 wei, reproduced with zero variance) to a fresh attacker on Ethereum; the dormant keeper proxy's unprotected drain settled its four undealt 2020 ETH-A liquidation auctions (#1457-1460, 50 WETH each) and swept the freed collateral out - not a MakerDAO core bug, the keeper impl's drain selector simply omits the ds-auth modifier that the contract's other functions carry

forge test --contracts src/test/2026-10/MakerDAOFlipKeeper_exp.sol -vvv

Contract

MakerDAOFlipKeeper_exp.sol

20261003 MALT - the MALT/DAI sLP runs its below-peg price recovery inside swap() before sending the output, pulling DAI from the Capital Source treasury into the pool, then checks its constant-product invariant against the final balances without separating the injected treasury DAI from the caller's own input, so a negligible 1 DAI swap is credited with thousands of injected DAI and releases a disproportionate MALT output

Lost: 13,440.581562307921517594 DAI net profit to the attacker (exactly reproduced) on Polygon; the Capital Source treasury was drained of 12,744.644506590589136718 DAI across two below-peg rebalance injections, the attacker paying just 1 DAI per exploit swap and arbitraging the extracted MALT out on QuickSwap - the ~$72K figure in the original alert does not match the on-chain reconstruction

forge test --contracts src/test/2026-10/MALT_exp.sol -vvv

Contract

MALT_exp.sol

20261002 GoldPesa - the GPX V4 hook rebalances protocol liquidity inside beforeSwap via a burn and TAKE_PAIR that run in the attacker's own open PoolManager unlock, and never checks the PositionManager deltas are settled first, so an unsettled mint debt parked in the same unlock nets against the hook's burn credit and the attacker walks the freed USDC out

Lost: 114,999.999186 USDC (exactly reproduced) on Base; the GPX/USDC V4 pool's protocol liquidity was burned by the hook's own hourly rebalance, and its 148,868.602188 USDC burn credit was split by the shared-unlock delta bug - 33,868.603002 USDC reached the hook while 114,999.999186 USDC paid off the attacker's unsettled mint debt and then exited to the attacker, funded by a 175,000 USDC Morpho flash loan repaid in the same tx

forge test --contracts src/test/2026-10/GoldPesa_exp.sol --evm-version cancun -vvv

Contract

GoldPesa_exp.sol

20261001 FlashLoopAdapter - a Safe module authenticates its caller by asking that caller whether the module is enabled (self-attestation) and then makes an unconstrained call to a caller-supplied router, letting a fake Safe drive the adapter into draining real Safes that enabled it

Lost: 114.096151 WETH (~$305k, exactly reproduced) on Ethereum; two Safes that enabled the module as a victim were emptied - Safe #1 lost 1306.48 weETH of Aave collateral once its 1335.26 WETH debt was repaid, Safe #2 lost 6.426 weETH, all swapped to WETH via ODOS for the attacker's net

forge test --contracts src/test/2026-10/FlashLoopAdapter_exp.sol --evm-version cancun -vvv

Contract

FlashLoopAdapter_exp.sol

20260930 SKYDAO - sell-path controller burns the pair's SKYDAO and syncs before the net sell is credited, latching a near-zero reserve that a direct pair.swap drains for the pair's entire USDT

Lost: 59,914.12 USDT net to the attacker (exactly reproduced) on BNB Chain; the SKYDAO/USDT PancakeSwap V2 pair lost its entire 183,482.88 USDT reserve, drained by a direct pair.swap against the reserve the sell-path burn+sync latched to ~0

forge test --contracts src/test/2026-09/SKYDAO_exp.sol --evm-version cancun -vvv

Contract

SKYDAO_exp.sol

20260930 PositionManager - deposit values the vault's existing USDT at the manipulable PancakeSwap V3 spot price, so crashing the spot before depositing mints inflated shares that withdraw redeems in the same transaction

Lost: 32,080.604282 USDT (exactly reproduced) on BNB Chain; one atomic tx crashed the USDT/BTCB spot with an 8,000,000 USDT swap, then ran 24 deposit(1,000,000 USDT)/withdraw cycles to drain the vault's own PancakeSwap V3 position, the pool losing 32,096.098596 USDT

forge test --contracts src/test/2026-09/PositionManager_exp.sol -vvv

Contract

PositionManager_exp.sol

20260930 MUS - deposit refunds a first-deposit bonus and also credits it as withdrawable allocation, so a single deposit-withdraw from a fresh address returns more ETH than deposited

Lost: ~0.400168 ETH per deposit-withdraw cycle (exactly reproduced) on Ethereum; the MUS pool's standing 5.335 ETH was drained to 0 across the attack block, reported campaign total ~$36.9k across many fresh addresses

forge test --contracts src/test/2026-09/MUS_exp.sol -vvv

Contract

MUS_exp.sol

20260929 LPBonus - reserve inconsistency between reward accrual and LP withdrawal lets a manipulated MSN reserve inflate an LP reward claim

Lost: 92,607 USDT ($92.6k) on BNB Chain; one LP position claimed 1,442,165.713011 FIST against an accrual that funded ~940,041.612768 FIST, extracted by flash-swapping the MSN reserve down at accrual and back up at withdrawal

forge test --contracts src/test/2026-09/LPBonus_exp.sol -vvv

Contract

LPBonus_exp.sol

20260926 DAOstack - permissionless newOrganization lets an attacker hijack an existing Reputation contract and drain the Avatar

Lost: 4.025 ETH (full Genesis Alpha treasury); attacker minted 20,000 REP against the victim's real Reputation contract (supply 9,738.6 to 29,738.6, ~67% majority after a 200 REP GenesisProtocol vote-cost burn) and used it to self-install as a full-permission scheme

forge test --contracts src/test/2026-09/DAOstack_exp.sol -vvv

Contract

DAOstack_exp.sol

20260923 PancakeV3SwapHelper - Signed Swap Delta Accounting Error

Lost: 1.6488688845 BNB ($1.3K)

BSC_RPC=https://bsc-mainnet.public.blastapi.io forge test --contracts ./src/test/2026-09/PancakeV3SwapHelper_exp.sol -vvv --evm-version shanghai

Contract

PancakeV3SwapHelper_exp.sol

Link reference

https://bscscan.com/tx/0x70bc4ff8439f74d26d454a53e9a135ac3659a958aa3462218d0db7ed55cf5104

20260921 DoinGud - acceptOffer replay via missing offer cleanup on the amount=0 path

Lost: 35,380.154566 USDC net (two byte-identical acceptOffer calls each paid out 35,486.935717 USDC from escrow; funded via a UniV2 flash swap, repaid 35,593.716868 USDC)

forge test --contracts src/test/2026-09/DoinGud_exp.sol -vvv

Contract

DoinGud_exp.sol

20260921 GaslessReservoirEnabler - erc20WithTransfersAndExecute lets a whitelisted module run unvalidated transferFrom calldata

Lost: 8.72 WETH ($23.8K) across 466 victims with standing approvals to the Enabler; PoC reproduces 3 victims, 2.3546 WETH ($6.4K, ~27% of the WETH-leg loss)

forge test --contracts src/test/2026-09/GaslessReservoirEnabler_exp.sol -vvv

Contract

GaslessReservoirEnabler_exp.sol

20260921 InternetToken - permissionless swapV3 with caller-supplied pool lets a fake callback mint INT arbitrarily

Lost: 764,145,702 INT + 5.846988 WETH (attacker minted 925.41M INT total, dumped 161.27M into the real INT/WETH pool for the WETH, reproduced to the wei)

forge test --contracts src/test/2026-09/InternetToken_exp.sol -vvv

Contract

InternetToken_exp.sol

20260918 Likwid - missing pairDelta update in leverage=0 margin borrow freezes AMM quote

Lost: 74.31 BNB (reproduced to within 3 wei)

BSC_RPC=https://bsc-mainnet.public.blastapi.io forge test --contracts src/test/2026-09/Likwid_exp.sol -vvv

Contract

Likwid_exp.sol

20260916 Startale - transient storage init flag outlives the constructor and lets anyone reinitialize an ERC7579 account and drain it

Lost: 427.551160 USDC drained in this batch tx (32.555561 USDC reproduced across 3 of 23 victim accounts; ~$2,876 USDC+USDT aggregate across 41 known batches)

forge test --contracts src/test/2026-09/Startale_exp.sol -vvv

Contract

Startale_exp.sol

20260916 Flamincome - permissionless Convex stakeFor inflates Strategy NAV and lets VaultYUSDT overpay on withdrawAll

Lost: ~$345.9K USDT net attacker profit (gross Strategy loss ~$595K in aUSDT+USDT)

forge test --contracts src/test/2026-09/Flamincome_exp.sol -vvv

Contract

Flamincome_exp.sol

20260916 PrimeFinance - permissionless stale signed oracle report overwrite drains lending pool

Lost: 425.5 WHYPE ($33.4K) drained from the lending pool reserve

forge test --contracts src/test/2026-09/PrimeFinance_exp.sol -vvv

Contract

PrimeFinance_exp.sol

20260916 Nimiq - GSN forwarder skips signature check, relying solely on attacker-chosen paymaster

Lost: ~$50,463.79 (USDC, USDT0, USDC.e drained from a swap-liquidity wallet's standing approvals)

forge test --contracts src/test/2026-09/Nimiq_exp.sol -vvv

Contract

Nimiq_exp.sol

20260915 RsETHSafeModule - nested self-referential multicall authorization bypass drains Gnosis Safe via DELEGATECALL

Lost: 2,900 aEthrsETH (~$7.8M gross; 2,882.37 rsETH / ~$7.73M net to the MEV frontrunner)

forge test --contracts src/test/2026-09/RsETHSafeModule_exp.sol -vvv

Contract

RsETHSafeModule_exp.sol

20260915 BonfireSwap - missing caller authorization lets anyone force-sell any approved holder's tokens

Lost: 66 BNB ($47-50K); 58.78 BNB reproduced from a 5-victim subset (~98.7% of tokens drained)

forge test --contracts src/test/2026-09/BonfireSwap_exp.sol -vvv

Contract

BonfireSwap_exp.sol

20260912 SpiralHookV2 - Uniswap V4 spot-price borrow plus tx.origin-keyed same-block guard bypass

Lost: ~10.70728 ETH (reproduced exact to the wei)

forge test --contracts src/test/2026-09/SpiralHookV2_exp.sol --evm-version cancun -vvv

Contract

SpiralHookV2_exp.sol

20260912 YamFinance - dormant-DAO quorum governance takeover drains legacy UMA farming contracts

Lost: ~$121K (48.085 WETH + 763.101 UMA)

forge test --contracts src/test/2026-09/YamFinance_exp.sol -vvv

Contract

YamFinance_exp.sol

20260911 ORB - leveraged pool buyout + refund-before-sell reentrancy drains burnLP-depleted reserve

Lost: 44.9-45 BNB ($32,610.72)

forge test --contracts src/test/2026-09/ORB_exp.sol -vvv --evm-version cancun

Contract

ORB_exp.sol

20260911 GDC - chained EOA bypass, liquidity misclassification, burn mismatch, and reentrant tax-free exit

Lost: ~35.34 BNB (35.337151495976986490 BNB reproduced exact to the wei)

forge test --contracts src/test/2026-09/GDC_exp.sol -vvv

Contract

GDC_exp.sol

20260909 EtherFiAtomicQueue - missing solver access control drains victim allowances

Lost: ~15.45 ETH (9 real victims' standing liquidETH allowances drained)

forge test --contracts src/test/2026-09/EtherFiAtomicQueue_exp.sol -vvv

Contract

EtherFiAtomicQueue_exp.sol

20260909 OMNI404 - ERC-404 dual ID/amount transfer interpretation drains pool WETH

Lost: 2.427 WETH (run() leg reproduced here; ~3.02 ETH across the full 4-tx block)

forge test --contracts src/test/2026-09/OMNI404_exp.sol -vvv

Contract

OMNI404_exp.sol

20260909 UnifiProtocol - unregistered caller-supplied pool trusted for reward eligibility and math

Lost: ~5.86 BNB (treasury still holds ~9.17 BNB, contract unpaused — bug remains re-exploitable)

forge test --contracts src/test/2026-09/UnifiProtocol_exp.sol -vvv

Contract

UnifiProtocol_exp.sol

20260909 BeatXswap - slot0 spot-price oracle with no TWAP guard drains vesting BTX reserves

Lost: ~$63.7K USDT net profit (2,984,557 BTX / ~$77.5K drained from two vesting reserves)

forge test --contracts src/test/2026-09/BeatXswap_exp.sol -vvv

Contract

BeatXswap_exp.sol

20260909 EnsoFinance - short-window Uniswap V3 TWAP oracle enables ~9x overvalued strategy deposit

Lost: ~5.6 ETH (5.277 ETH realized in this PoC after slippage selling looted UNI/AAVE/MKR back to WETH)

forge test --contracts src/test/2026-09/EnsoFinance_exp.sol -vvv

Contract

EnsoFinance_exp.sol

20260909 ZentraFinance - aToken burn safeguard clamps to zero, repayWithATokens clears debt without burning

Lost: 140,000 ctUSD + 30 USDC.e ($143K)

forge test --contracts src/test/2026-09/ZentraFinance_exp.sol -vvv

Contract

ZentraFinance_exp.sol

20260908 OrderFactory - missing access control on createOrderForBuyer drains buyer accounts

Lost: ~20.247 ETH this tx (5 buyers drained; reported incident total ~24.7 ETH)

forge test --contracts src/test/2026-09/OrderFactory_exp.sol -vvv

Contract

OrderFactory_exp.sol

20260907 RouterDrain - permissionless swap entry lets a fake V3 pool abuse router allowances

Lost: ~62.28 WBNB across 29 victims (3 reconstructed here: OCEAN, Kandura, SATURN)

forge test --contracts src/test/2026-09/RouterDrain_exp.sol -vvv

Contract

RouterDrain_exp.sol

20260907 CozyFinance - unverified UMA Optimistic Oracle trigger enables unbacked protection-token redemption

Lost: 160,776 USDC.e ($160K)

forge test --contracts src/test/2026-09/CozyFinance_exp.sol -vvv

Contract

CozyFinance_exp.sol

20260905 DHC - repeatable claim due to missing claimed-flag

Lost: ~$71.8K USDT

forge test --contracts src/test/2026-09/DHC_exp.sol -vvv

Contract

DHC_exp.sol

Lost: ~9.25 ETH

forge test --contracts src/test/2026-09/Reddio_exp.sol -vvv

Contract

Reddio_exp.sol

20260905 SecuredFi - same-block self-trade manipulates getMarketUnitPrice to fabricate collateral

Lost: 0.9 WBTC ($72K single-drain; ~$104K across all actors exploiting the same public bug)

forge test --contracts src/test/2026-09/SecuredFi_exp.sol -vvv

Contract

SecuredFi_exp.sol

20260903 NotionalFinance - ERC1155 fCash mint overflow drains escrow

Lost: ~69,257.37 DAI + 1,658,524.86 USDC ($1.73M)

forge test --contracts src/test/2026-09/NotionalFinance_exp.sol -vvv

Contract

NotionalFinance_exp.sol

20260901 ReflexerGEB - Shared GebProxyActions library registered as SAFE owner

Lost: 5.9436 ETH ($14K, drained from 4 SAFEs in one tx: IDs 3, 5, 8, 18)

forge test --contracts src/test/2026-08/ReflexerGEB_exp.sol -vvv

Contract

ReflexerGEB_exp.sol

20260831 FloatProtocol - Uniswap V3 spot price manipulation of Hypervisor LP shares

Lost: ~$28,000 (10.71 ETH)

forge test --contracts src/test/2026-08/FloatProtocol_exp.sol -vvv

Contract

FloatProtocol_exp.sol

20260831 BalancerV1BPool - joinswapPoolAmountOut rounding drain across 5 pools

Lost: $110,839 for this DPI/USDC/WETH/WBTC pool ($234K aggregate across all 5 vulnerable pools)

forge test --contracts src/test/2026-08/BalancerV1BPool_exp.sol -vvv

Contract

BalancerV1BPool_exp.sol

20260828 AjnaFinance - liquidation accounting manipulation via self-controlled auction

Lost: ~$124.8K for this cbETH pool (1 of 7 pools hit by the same bug the same day, ~$775K aggregate)

forge test --contracts src/test/2026-08/AjnaFinance_exp.sol -vvv

Contract

AjnaFinance_exp.sol

20260827 CashCowCoin - privileged burn + premature sync() drains PancakeSwap pair

Lost: 165.47 WBNB ($117.4K)

forge test --contracts src/test/2026-08/CashCowCoin_exp.sol --evm-version cancun -vvv

Contract

CashCowCoin_exp.sol

20260826 EnjinCryptoItems - unprotected registry reinitialization, manager takeover

Lost: 5,231,353 ENJ (~$142K)

forge test --contracts src/test/2026-08/EnjinCryptoItems_exp.sol -vvv

Contract

EnjinCryptoItems_exp.sol

20260825 FHToken - sell-tax reserve mismatch via premature sync()

Lost: 19,999.018106552928530404 USDT (~$20K)

forge test --contracts src/test/2026-08/FHToken_exp.sol --evm-version cancun -vvv

Contract

FHToken_exp.sol

20260823 ArrakisGUNI - Uniswap V3 spot-price manipulation of vault mint/burn

Lost: ~2.9414 ETH net attacker surplus (Arrakis V1 / G-UNI ENS-WETH vault)

forge test --contracts src/test/2026-08/ArrakisGUNI_exp.sol -vvv

Contract

ArrakisGUNI_exp.sol

20260823 TermFinance - Governance capture via thinly-wrapped Aragon voting power

Lost: 2,841.743535791961701401 WETH (attacker net gain, ETH meta-vault)

forge test --contracts src/test/2026-08/TermFinance_exp.sol -vvv

Contract

TermFinance_exp.sol

20260822 SandboxOFT - LayerZero delegate hijack via approveAndCall

Lost: 10,000,000 SAND minted unbacked (~$517,170 face value, one of 400+ repeated txs in an ongoing campaign)

forge test --contracts src/test/2026-08/SandboxOFT_exp.sol -vvv

Contract

SandboxOFT_exp.sol

20260819 AllbridgeCCTP - Phantom deposit via unverified message attestation

Lost: ~189,751.554381 USDC

forge test --contracts src/test/2026-08/AllbridgeCCTP_exp.sol --evm-version cancun -vvv

Contract

AllbridgeCCTP_exp.sol

20260809 USM - defund() price split-invariance rounding exploit

Lost: ~70.83 ETH

forge test --contracts src/test/2026-08/USM_exp.sol -vvv

Contract

USM_exp.sol

20260806 UnistreetLaunchpad - arbitrary call injection via unvalidated launch forwarding

Lost: ~17,743.91 USDC + 0.0072 WETH ($17.75K)

forge test --contracts src/test/2026-08/UnistreetLaunchpad_exp.sol -vvv

Contract

UnistreetLaunchpad_exp.sol

20260805 StrongBlock - governance takeover of an abandoned Governor

Lost: 32,695.761681 STRONG + 383,447.167299 STRNGR (~$72K)

forge test --contracts src/test/2026-08/StrongBlock_exp.sol -vvv

Contract

StrongBlock_exp.sol

20260803 AIC - pair skim / reserve-mismatch exploit, flash-swap leveraged

Lost: 32.36 BNB ($21.5K)

forge test --contracts src/test/2026-08/AIC_exp.sol -vvv

Contract

AIC_exp.sol

20260802 MOKE - settle() tx.origin check lets any EOA latch a manipulated MOKE/USDT price, then claim() mints inflated MOKE against it

Lost: ~1546.54 BNB (~41.68M MOKE over-minted)

forge test --contracts src/test/2026-10/MOKE_exp.sol --evm-version prague -vvv

Contract

MOKE_exp.sol

20260716 CrowdRingCircle - sell-destroy path burns CRC out of the pair on any non-exempt sell, collapsing the reserve so a follow-up swap drains the pool's USDT

Lost: ~201.36K USDT

forge test --contracts src/test/2026-10/CrowdRingCircle_exp.sol -vvv

Contract

CrowdRingCircle_exp.sol

20260716 PerpetualProtocol - v2 (Curie) unguarded OrderBook funding-growth update lets anyone poison cached funding, draining the Vault

Lost: ~3,062.21 USDC

forge test --contracts src/test/2026-10/PerpetualProtocol_exp.sol --evm-version cancun -vvv

Contract

PerpetualProtocol_exp.sol

20260706 SummerFi - FleetCommander NAV Inflation via Depegged xUSD

Lost: ~$6M (DAI + LVUSDC shares)

forge test --contracts ./src/test/2026-07/SummerFi_exp.sol -vvv --evm-version cancun

Contract

SummerFi_exp.sol

Link reference

https://etherscan.io/tx/0x0db528c44f23fc7fa4544684a2fab81096450a14aae8bc89f42cd0592d43da12

20260701 edel-xstock - Price Oracle Manipulation

Lost: 204,215.57 USDC

forge test --contracts ./src/test/2026-07/edel-xstock_exp.sol -vvv

Contract

edel-xstock_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2072130807356129726

20260629 Vault4626 - Business Logic Flaw

Lost: 13.53 WETH

forge test --contracts ./src/test/2026-06/Vault4626_exp.sol --evm-version shanghai -vvv

Contract

Vault4626_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2071495744071086510

20260628 AIDC - Business Logic Flaw

Lost: 220.13 WBNB

forge test --contracts ./src/test/2026-06/AIDC_exp.sol -vvv --evm-version shanghai

Contract

AIDC_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2071415914948685892

20260627 CookFinanceIssuance - Price Oracle Manipulation

Lost: ~$50K

forge test --contracts ./src/test/2026-06/CookFinanceIssuance_exp.sol -vvv --evm-version shanghai

Contract

CookFinanceIssuance_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2071497001443770684

20260625 LixirPermitDrain - Broken Signature Verification

Lost: 2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX

forge test --contracts ./src/test/2026-06/LixirPermitDrain_exp.sol -vvv

Contract

LixirPermitDrain_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2070362661691207935

20260625 OceanBPoolSideStaking - BPool single-sided join/exit math with SideStaking gulp accounting

Lost: 127.86K mOCEAN

forge test --contracts ./src/test/2026-06/OceanBPoolSideStaking_exp.sol -vvv

Contract

OceanBPoolSideStaking_exp.sol

Link reference

http://x.com/defimonalerts/status/2070362661540286735

20260624 DLMC - Reserve-derived livePrice manipulation

Lost: 222,560.22 USDT

forge test --contracts ./src/test/2026-06/DLMC_exp.sol -vvv --evm-version cancun

Contract

DLMC_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2069957542109958498

20260623 RoyalRoyalties - Zero-amount ERC1155 batch transfer inflated Royal LDA tier balance

Lost: 261,162.93 USDC

forge test --contracts ./src/test/2026-06/RoyalRoyalties_exp.sol -vvv

Contract

RoyalRoyalties_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2069596801725002121

20260622 Aztec Escape Hatch - proof_id Accounting Bypass (whitehat reproduction)

Lost: N/A (purely educational; worst-case impact would have been ~$2M, matching the separate vulnerability that actually drained the contracts)

forge test --contracts src/test/2026-06/AztecEscapeHatch_exp2.sol -vvv

Contract

AztecEscapeHatch_exp2.sol

Link reference

https://github.com/AztecProtocol/aztec-2.0

https://x.com/ivanbogatyy/status/2069159603942596830

20260622 ATM - LP Token Burn

Lost: 1,603.99 WBNB

forge test --contracts ./src/test/2026-06/ATM_LP_Burn_exp.sol -vvv --evm-version shanghai

Contract

ATM_LP_Burn_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2068993748936151209

20260620 OLPC - OLPC pair reserve manipulation

Lost: 1,115,903.66 USDT

forge test --contracts ./src/test/2026-06/OLPC_exp.sol --evm-version shanghai -vvv

Contract

OLPC_exp.sol

Link reference

https://x.com/exvulsec/status/2068308334512365924

20260618 JB - JB helper repeated cycle drains JB/USDT pair

Lost: 49,958.06 USDT

forge test --contracts ./src/test/2026-06/JB_exp.sol -vvv --evm-version cancun

Contract

JB_exp.sol

Link reference

https://x.com/audit_911/status/2067943961327763788

20260617 Aztec V1 - escapeHatch Proof-Forgery (permissionless RollupProcessor exit)

Lost: ~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC)

forge test --contracts src/test/2026-06/AztecEscapeHatch_exp.sol -vvv

Contract

AztecEscapeHatch_exp.sol

20260617 WHALE - Transfer Accounting Reserve Desync

Lost: 3,460.41 USDT

forge test --contracts ./src/test/2026-06/WHALE_exp.sol -vvv --evm-version cancun

Contract

WHALE_exp.sol

Link reference

https://x.com/audit_911/status/2067451654694412720

20260617 LBP - LBP balanceOf reward accounting

Lost: 610.56 BNB

forge test --contracts ./src/test/2026-06/LBP_exp.sol -vvv --evm-version cancun

Contract

LBP_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2067329401977532429

20260616 DIP - Fee-on-Transfer Reserve Manipulation

Lost: 111,097.59 USDC

forge test --contracts ./src/test/2026-06/DIP_exp.sol -vvv --evm-version shanghai

Contract

DIP_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2067059314519417163

Lost: 105471.50 USDC

forge test --contracts ./src/test/2026-06/Thetanuts_exp.sol -vvv

Contract

Thetanuts_exp.sol

Link reference

https://x.com/PeckShieldAlert/status/2066540451126190312

20260614 Aztec Connect - numRealTxs Proof/Settlement Mismatch (permissionless RollupProcessorV3)

Lost: ~$2.19M (this PoC reproduces the 908.99 ETH leg)

forge test --contracts src/test/2026-06/AztecConnect_exp.sol -vvv

Contract

AztecConnect_exp.sol

Link reference

https://www.cryptotimes.io/2026/06/15/aztec-exploit-drains-2-19m-from-dormant-privacy-protocol/

https://dev.to/cryip/how-a-single-validation-mismatch-can-drain-millions-lessons-from-the-aztec-connect-exploit-2598

20260609 TOPBPool - Governance-controlled token mint and Balancer pool drain

Lost: 944.20 WETH

forge test --contracts ./src/test/2026-06/TOPBPool_exp.sol -vvv

Contract

TOPBPool_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2064616112822583505

20260609 NovaBox - Constructor Dividend Checkpoint Bypass

Lost: 56.73 ETH

forge test --contracts ./src/test/2026-06/NovaBox_exp.sol --evm-version prague -vvv

Contract

NovaBox_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2064616360466919793

20260607 AmbientCrocSwapDex - Native surplus accounting flaw

Lost: 67.85 ETH

forge test --contracts ./src/test/2026-06/AmbientCrocSwapDex_exp.sol -vvv

Contract

AmbientCrocSwapDex_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2063816231023427861

20260606 BOSS - BOSS helper mint/burn and transfer-tax pool skew

Lost: 10,207.54 USDT

forge test --contracts ./src/test/2026-06/BOSS_exp.sol -vvv --evm-version shanghai

Contract

BOSS_exp.sol

Link reference

https://x.com/audit_911/status/2063819348305985748

20260605 DTXT - Liquidity Misclassification Fee Bypass

Lost: 35,041.11 USDT

forge test --contracts ./src/test/2026-06/DTXT_exp.sol -vvv --evm-version shanghai

Contract

DTXT_exp.sol

Link reference

https://x.com/audit_911/status/2063793931138347015

20260605 AISOTHPresale - Fixed-price presale arbitrage

Lost: 30,314.76 USDT

forge test --contracts ./src/test/2026-06/AISOTHPresale_exp.sol -vvv --evm-version shanghai

Contract

AISOTHPresale_exp.sol

Link reference

https://x.com/audit_911/status/2063565495073415618

20260604 BYToken - Permissionless triggerAutoBurn Reserve Manipulation

Lost: ~$87,402 (146.60 WBNB)

forge test --contracts src/test/2026-06/BYToken_exp.sol -vvv

Contract

BYToken_exp.sol

Link reference

https://hacked.slowmist.io

20260604 ATM Token - Hidden transferFrom Auto-Swap Drain

Lost: ~$243,543 USDT

forge test --contracts src/test/2026-06/ATM_exp.sol -vvv

Contract

ATM_exp.sol

Link reference

https://hacked.slowmist.io

20260530 AROS - Signature Replay

Lost: ~$295K

forge test --contracts src/test/2026-05/AROS_exp.sol -vvv --evm-version prague

Contract

AROS_exp.sol

Link reference

https://bscscan.com/tx/0xe89fe640ec5241edfca7d8dcae77a0a4270dee15e4bbd043fc60e393aabf41e1 https://x.com/TenArmorAlert/status/2061289921990570349

20260529 YSDAO - Price Manipulation and Tax Bypass

Lost: ~19.49K USDT

forge test --contracts src/test/2026-05/YSDAO_exp.sol -vvv

Contract

YSDAO_exp.sol

Link reference

https://bscscan.com/tx/0x91f26d96373bbec6a6a8517c7be995a739d65f20fed589d53bc47d8140f91907

20260528 LegendaryMoneyMonNft - ecrecover address(0) Signature Bypass

Lost: ~$85.5K USD (85,519 USDT)

forge test --contracts src/test/2026-05/LegendaryMoneyMonNft_exp.sol -vvv

Contract

LegendaryMoneyMonNft_exp.sol

Link reference

https://x.com/SlowMist_Team/status/2060205558687486441

20260528 DxSale - Ownership Override Attack

Lost: ~7.3M USD

forge test --contracts src/test/2026-05/DxSale_exp.sol -vvv

Contract

DxSale_exp.sol

Link reference

https://crypto.news/dxsale-exploit-drains-7-3m-in-bnb-through-hidden-contract-backdoor/ https://x.com/Tahax1/status/1928169316736651568 https://x.com/CoinsultAudits/status/1928203831996297670

20260527 Joe Agent - Reentrancy in removeLiquidityViaContract

Lost: ~$45K USD (62.5 BNB + ~1.196M JOE)

forge test --contracts src/test/2026-05/JoeAgent_exp.sol -vvv

Contract

JoeAgent_exp.sol

Link reference

https://x.com/SlowMist_Team/status/2059887450663551352

20260526 SKP Token - Owner Backdoor LP Burn + Price Manipulation

Lost: ~$212K USD

forge test --contracts src/test/2026-05/SKP_exp.sol -vvv

Contract

SKP_exp.sol

Link reference

https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/

20260526 SKP Token - Deliberately Engineered Drain (Insider Exploit / Rug Pull)

Lost ~$212,195 USDT

Classification: Premeditated insider exploit — NOT a conventional external hack.

forge test --contracts src/test/2026-05/SKP_exp2.sol -vvv

Contract

SKP_exp2.sol

Link reference

20260525 SquidRouterModule - Missing caller check

Lost: 0.25 WBTC + 0.29 wTAO + 0.02 WETH

FOUNDRY_EVM_VERSION=cancun forge test --contracts ./src/test/2026-05/SquidRouterModule_exp.sol -vvv

Contract

SquidRouterModule_exp.sol

Link reference

https://t.me/defimon_alerts/3045

20260525 New Market Trading - SquidRouterModule Missing Caller Check

Lost: ~$3.98M USD

FOUNDRY_EVM_VERSION=cancun forge test --contracts src/test/2026-05/NewMarketTrading_exp.sol --match-contract NewMarketTradingExploit -vv

Contract

NewMarketTrading_exp.sol

Link reference

https://rekt.news/newmarkettrading-rekt

20260525 WUSD.fi - _englove Sybil Incentive Abuse

Lost: ~$200K USD (GLOVE emissions + LP drain)

forge test --contracts src/test/2026-05/WUSD_exp.sol -vvv

Contract

WUSD_exp.sol

Link reference

https://x.com/exvulsec/status/2058803971947385330

20260522 FractalProtocol - Business Logic Flaw

Lost: ~$13.7K

forge test --contracts src/test/2026-05/FractalProtocol_exp.sol -vvv

Contract

FractalProtocol_exp.sol

Link reference

https://arbiscan.io/tx/0x20db78913a51c3b3aece860ea142c240f3f8fa3b5bbf533a3d1d48eed857e10f https://x.com/DefimonAlerts/status/2058619391776878967

20260521 MureDistribution - Signature Verification Bypass

Lost: ~5.45 ETH

forge test --contracts src/test/2026-05/MureDistribution_exp.sol -vvv

Contract

MureDistribution_exp.sol

Link reference

https://etherscan.io/tx/0xb83040361a0ec72fa2d06ad69493226518a5f8b5d96c19b400626248f9c5b798 https://x.com/DefimonAlerts/status/2058211424761942226

20260520 MAPProtocol - Arbitrary Mint

Lost: ~$180K

forge test --contracts src/test/2026-05/MAPProtocol_exp.sol -vvv

Contract

MAPProtocol_exp.sol

Link reference

https://etherscan.io/tx/0x31e56b4737649e0acdb0ebb4eca44d16aeca25f60c022cbde85f092bde27664a https://x.com/MapProtocol/status/2059587998409490510

20260519 ElevateFi - Reserve Price Manipulation

Lost: ~16,000 USD

forge test --contracts ./src/test/2026-05/ElevateFi_exp.sol -vvv --evm-version cancun

Contract

ElevateFi_exp.sol

Link reference

https://t.me/defimon_alerts/3040

20260518 TesseraSwap - Callback Repayment Price Spread

Lost: ~$20K

forge test --contracts ./src/test/2026-05/TesseraSwap_exp.sol -vvv --evm-version shanghai

Contract

TesseraSwap_exp.sol

Link reference

https://t.me/defimon_alerts/3038

20260517 VerusBridge - Insufficient Validation

Lost: ~$11.58M

forge test --contracts src/test/2026-05/VerusBridge_exp.sol -vvv

Contract

VerusBridge_exp.sol

Link reference

https://etherscan.io/tx/0x6990f01720f57fc515d0e976a0c4f8157e0a9529194c4c15d190e98d087eb321 https://x.com/VerusCoin/status/2057465214975492358

20260517 SEAToken - Business Logic Flaw

Lost: ~$110K

forge test --contracts src/test/2026-05/SEAToken_exp.sol -vvv

Contract

SEAToken_exp.sol

Link reference

https://arbiscan.io/tx/0x001cb16e17c4c5a5c4d02423c9e9b2f2b11ab6b2a1baf2ba53b8fcaf06167716 https://anomly.rs/metasea-redeemposition-distributor-drain-arb-2026-05-17

20260515 AdsharesBridge - Insufficient Validation

Lost: ~$628K

forge test --contracts src/test/2026-05/AdsharesBridge_exp.sol -vvv

Contract

AdsharesBridge_exp.sol

Link reference

https://etherscan.io/tx/0x8844b4ec371c4b13d7fac701b5d546a7c2fba12621a9596dd14b662b14408789 https://etherscan.io/tx/0xfba82bb34515d7aefbf0c89582b71d915ec8861c96babaafdc882743dbc23509 https://etherscan.io/tx/0xa3476575183204b4a662dd6ee56f6499d806e4f41ce83d98366752d31e9e9ca3 https://x.com/DefimonAlerts/status/2055751467579936770

20260512 SQTokenStaking - Access Control

Lost: ~$346.1K

forge test --contracts src/test/2026-05/SQTokenStaking_exp.sol -vvv --evm-version prague

Contract

SQTokenStaking_exp.sol

Link reference

https://bscscan.com/tx/0x1bae633eda9b3d98999ea116bc403712eaa07093ec32bd6d559085cc4607f5b8 https://x.com/Defi_Nerd_sec/status/2054425936746148148

20260511 INKFinance - Business Logic Flaw

Lost: ~$140K

forge test --contracts src/test/2026-05/INKFinance_exp.sol -vvv

Contract

INKFinance_exp.sol

Link reference

https://polygonscan.com/tx/0xb469a24ec737be16fe41367a7b5b315c7f03b4e0ff3af50b3a2db03b3066b982 https://www.cryptotimes.io/2026/05/11/ink-finance-exploited-on-polygon-140k-usdt-drained-in-flash-loan-attack/

20260511 HumaFinance - Credit Approval Bypass

Lost: ~$101K (82,315 USDC + 19,074 USDC.e)

forge test --contracts src/test/2026-05/HumaCreditApprovalBypass_exp.sol -vv

Contract

HumaCreditApprovalBypass_exp.sol

Link reference

https://www.cryptotimes.io/2026/05/11/huma-finance-v1-exploit-on-polygon-drains-101k-in-usdc/

20260510 Renegade - Uninitialized Proxy

Lost: ~$209K

forge test --contracts src/test/2026-05/Renegade_exp.sol -vvv

Contract

Renegade_exp.sol

Link reference

https://arbiscan.io/tx/0x0e494685ace16d372066c5b4db959b58ebac6d88166c2d9d618e0e421dc0c77e https://x.com/renegade_fi/status/2053531772634427599 https://x.com/DefimonAlerts/status/2053538325969977801

20260507 TrustedVolumes - Signature Replay

Lost: ~$5.87M

forge test --contracts src/test/2026-05/TrustedVolumes_exp.sol --match-contract TrustedVolumesExploit -vv

Contract

TrustedVolumes_exp.sol

Link reference

https://rekt.news/trustedvolumes-rekt https://www.darknavy.org/web3/exploits/trustedvolumes-rfq-proxy-drain/ https://blog.verichains.io/p/trustedvolumes-exploit-analysis

20260505 Ekubo - Business Logic Flaw

Lost: ~$1.4M

forge test --contracts src/test/2026-05/Ekubo_exp.sol -vvv

Contract

Ekubo_exp.sol

Link reference

https://etherscan.io/tx/0x770bc9a1f7c32cb63a5002b9ceb5c7994cd3af0fc6b2309cb32d3c46f629daa0 https://x.com/EkuboProtocol/status/2051754481465856038 https://x.com/blockaid_/status/2051757787714118125

20260501 SharwaMarginTrading - Hegic collateral spot price manipulation

Lost: 32.85K USDC

forge test --contracts ./src/test/2026-05/SharwaMarginTrading_exp.sol -vvv

Contract

SharwaMarginTrading_exp.sol

Link reference

https://t.me/defimon_alerts/2975

20260428 RWAVault - Missing ERC4626 allowance check

Lost: 398,655.47 USDC

forge test --contracts ./src/test/2026-04/RWAVault_exp.sol -vvv

Contract

RWAVault_exp.sol

Link reference

https://t.me/defimon_alerts/2958

20260428 JUDAO - JUDAO sell-hook reserve drain

Lost: 205K USDT + 36 BNB

forge test --contracts ./src/test/2026-04/JUDAO_exp.sol -vvv --evm-version shanghai

Contract

JUDAO_exp.sol

Link reference

https://t.me/defimon_alerts/2955

20260427 Unverified_a152 - AllowanceTarget approval drain

Lost: 229K USDT

forge test --contracts ./src/test/2026-04/unverified_a152_exp.sol -vvv

Contract

unverified_a152_exp.sol

Link reference

https://t.me/defimon_alerts/2987

Lost: 413.13K USDC

forge test --contracts ./src/test/2026-04/SingularityDynaVault_exp.sol -vvv --evm-version shanghai

Contract

SingularityDynaVault_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2048698708309705069

20260423 GiddyVaultV3 - Incomplete Signature Coverage

Lost: $1.3M

forge test --contracts ./src/test/2026-04/giddyvaultv3_compound_auth_exp.sol -vvv --evm-version cancun

Contract

giddyvaultv3_compound_auth_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2047334517535642024

20260421 KipseliPropAMM - Pricing / Decimals Mismatch

Lost: 0.93 cbBTC

forge test --contracts ./src/test/2026-04/KipseliPropAMM_exp.sol -vvv --evm-version cancun

Contract

KipseliPropAMM_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2046873857571934254

20260420 JuiceboxREVLoans - Fake terminal loan source validation bypass

Lost: 21.77 ETH

forge test --contracts ./src/test/2026-04/JuiceboxREVLoans_exp.sol -vvv

Contract

JuiceboxREVLoans_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2046862935650345139

Lost: 0.15 WBTC

forge test --contracts ./src/test/2026-04/ThetanutsVaultShareRounding_exp.sol -vvv

Contract

ThetanutsVaultShareRounding_exp.sol

Link reference

https://t.me/defimon_alerts/2933

20260419 AaveRebalancerCreditDelegation - Arbitrary External Call / Credit Delegation Abuse

Lost: 6,999.91 WAVAX

forge test --contracts ./src/test/2026-04/AaveRebalancerCreditDelegation_exp.sol -vvv

Contract

AaveRebalancerCreditDelegation_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2046504796463808991

20260415 XLootStaking - Duplicate xLOOT Redemption

Lost: 6.21 ETH

forge test --contracts ./src/test/2026-04/XLootStaking_exp.sol -vvv

Contract

XLootStaking_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2044709964091187660

20260414 MONA LisaVault - reward-farming / BurnAddress accounting exploit!

Lost ~60.95K USDT

forge test --contracts src/test/2026-04/MONA_LisaVault_exp.sol -vvv

Contract

MONA_LisaVault_exp.sol

Link reference

https://x.com/exvulsec/status/2043928546662592949

20260414 Saturn Protocol - Vulnerability Disclosure

Lost: 0 (Disclosure only; no exploit occurred)

TVL at Risk: ~$35.7M

forge test --contracts src/test/2026-04/SaturnProtocol_exp.sol -vvv --fork-url https://rpc.ankr.com/eth

Contract

SaturnProtocol_exp.sol

Link reference

https://gist.github.com/sgInnora/b70ad98327649ed4ab976a122f45e485

Note: Vendor states SAT-001 (underflow) is mitigated by _validateTotals, and SAT-002 (tolerance compound) is a trusted-role design observation.

20260412 SubQuerySettings - Settings access control

Lost: 218.07M SQT

forge test --contracts ./src/test/2026-04/SubQuerySettings_exp.sol -vvv --evm-version shanghai

Contract

SubQuerySettings_exp.sol

Link reference

https://t.me/defimon_alerts/2909

20260407 SquidMulticallAllowanceDrain - Arbitrary Call / Wrong Approval

Lost: 1 ETH

forge test --contracts ./src/test/2026-04/SquidMulticallAllowanceDrain_exp.sol -vvv --evm-version shanghai

Contract

SquidMulticallAllowanceDrain_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2041530294369386806

20260405 PerpPair - Virtual AMM Manipulation

Lost: 165K USDC

forge test --contracts ./src/test/2026-04/PerpPair_exp.sol -vvv --evm-version prague

Contract

PerpPair_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2041070927908126897

20260331 WhalebitOracleManipulation - Algebra spot-price oracle manipulation

Lost: 824K USD

forge test --contracts ./src/test/2026-03/WhalebitOracleManipulation_exp.sol -vvv

Contract

WhalebitOracleManipulation_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2039372077686251787

20260328 VTSwapHook - Pricing Error in UniswapV4 Hook

Lost: 4,507,034.03 vATH + 2,007,935.14 ATH

forge test --contracts ./src/test/2026-03/VTSwapHook_exp.sol -vvv --evm-version cancun

Contract

VTSwapHook_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2038647146098954283

20260327 EST Token - Incorrect Token Burn Mechanism

Lost: 150.2 WBNB

forge test --contracts src/test/2026-03/EST_exp.sol -vvv --evm-version shanghai

Contract

EST_exp.sol

Link reference

https://bscscan.com/address/0xD4524Be41cd452576aB9FF7b68a0b89aF8498a91

20260324 XocolatlLiquidator - Access Control / Input Validation

Lost: 3.25 cbETH and 0.22 WETH

forge test --contracts ./src/test/2026-03/XocolatlLiquidator_exp.sol -vvv --evm-version shanghai

Contract

XocolatlLiquidator_exp.sol

Link reference

https://t.me/defimon_alerts/2834

20260324 Univ3CollateralToken - Logic Error

Lost: 57K USD

forge test --contracts ./src/test/2026-03/Univ3CollateralToken_exp.sol -vvv --evm-version shanghai

Contract

Univ3CollateralToken_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2036449500512891317

20260323 BCE - Deflationary Token Logic Error

Lost: ~800,000 USDT

forge test --contracts ./src/test/2026-03/bce_exp.sol -vvv --evm-version cancun

Contract

bce_exp.sol

Link reference

https://t.me/defimon_alerts/2814

20260319 ATMBlindBox - Weak Randomness / Predictable RNG

Lost: 99K USD

forge test --contracts ./src/test/2026-03/ATMBlindBox_exp.sol -vvv --evm-version shanghai

Contract

ATMBlindBox_exp.sol

Link reference

https://t.me/defimon_alerts/2808

20260319 Revamp - Reward Accounting Drain

Lost: 2.99 BNB

forge test --contracts ./src/test/2026-03/Revamp_exp.sol -vvv --evm-version cancun

Contract

Revamp_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2034532544239088053

20260316 unverified - CheckoutPool Old BOC Missing Access Control

Lost: 85,730 USDC

forge test --contracts ./src/test/2026-03/unverified_1304_exp.sol -vvv --evm-version cancun

Contract

unverified_1304_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2034532547191820390

20260315 Venus THE - BorrowBehalf + Donation Attack

Lost: 913,858.263360521396654198 CAKE + 1,972.530910582753621682 WBNB

forge test --contracts src/test/2026-03/Venus_THE_exp.sol --match-test testTraceDrivenPoC -vvv

Contract

Venus_THE_exp.sol

Link reference

https://bscscan.com/tx/0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f

20260315 StakeOnMe - Owner-privileged JAKE burn reserve drain

Lost: 0.28 ETH

forge test --contracts ./src/test/2026-03/unverified_237d_exp.sol -vvv

Contract

unverified_237d_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2034532549905580417

20260310 AlkemiEarn - Business Logic

Lost: 43.45 ETH

forge test --contracts ./src/test/2026-03/AlkemiEarn_exp.sol -vvv

Contract

AlkemiEarn_exp.sol

Link reference

https://x.com/blockaid_/status/2031351881029546194

Lost: ~240,000 US$

forge test -vvv --contracts ./src/test/2026-03/Curve_LlamaLend_exp.sol

Contract

Curve_LlamaLend_exp.sol

Link reference

https://x.com/yieldsandmore/status/2028368378457362629

20260222 LAXO Token - Incorrect Burn Logic

Lost: ~137,000 US$

forge test src/test/2026-02/LAXO_Token_exp.sol -vvv

Contract

LAXO_Token_exp.sol

Link reference

https://x.com/CertiKAlert/status/2027317095420072317

20260216 XDKRecycle - XDK recycle reserve manipulation

Lost: 6.84 WBNB

forge test --contracts ./src/test/2026-02/XDKRecycle_exp.sol -vvv --evm-version shanghai

Contract

XDKRecycle_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2024163654631882916

20260215 Moonwell - Faulty Oracle

Lost: 1.78M USD

forge test --contracts ./src/test/2026-02/Moonwell_exp.sol -vvv

Contract

Moonwell_exp.sol

Link reference

https://forum.moonwell.fi/t/mip-x43-cbeth-oracle-incident-summary/2068

https://forum.moonwell.fi/t/recovery-plan-cbeth-incident-and-moonwell-apollo-onboarding/2084

https://x.com/pashov/status/2023872510077616223

https://x.com/moo9000/status/2024040101982990534

20260120 SynapLogic - Business Logic Flaw

NOTICE: SynapLogic is totally a cheat contract, with backdoors, vulnerabilities and rug pulls.

Lost: 27.6 ETH & 3450 USDC

forge test -vvv --contracts ./src/test/2026-01/SynapLogic_exp.sol

Contract

SynapLogic_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2013432861366292520?s=20

https://x.com/hklst4r/status/2013440353844461979?s=20

https://x.com/CertiKAlert/status/2013440963851755610?s=20

https://x.com/nn0b0dyyy/status/2013445844394279260?s=20

20260120 Makina - Price Oracle Manipulation

Lost: 5.1M USD

forge test -vvv --contracts ./src/test/2026-01/makina_exp.sol --evm-version cancun
# MUST use evm >= cancun

Contract

makina_exp.sol

Link reference

https://x.com/nn0b0dyyy/status/2013472538832314630

https://x.com/TenArmorAlert/status/2013460083078836342

https://x.com/CertiKAlert/status/2013473512116363734

20260112 MTToken - Incorrect Fee Logic

Lost: 37K USD

forge test -vvv --contracts ./src/test/2026-01/MTToken_exp.sol

Contract

MTToken_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2010630024274010460?s=20

https://x.com/nn0b0dyyy/status/2010638145155661942?s=20

20260110 FutureSwap - Unit Mismatch

Lost: 433K USD

forge test -vvv --contracts ./src/test/2026-01/futureswap_exp.sol

Contract

futureswap_exp.sol

Link reference

https://x.com/nn0b0dyyy/status/2009922304927731717?s=20

20260109 Truebit - OverFlow

Lost: 8540ETH

forge test --contracts ./src/test/2026-01/Truebit_exp.sol -vvv

Contract

Truebit_exp.sol

Link reference

https://www.certik.com/zh-CN/resources/blog/truebit-incident-analysis

20260101 PRXVT - Bussiness Logic Flaw

Lost: 32.8 ETH

forge test --contracts ./src/test/2026-01/PRXVT_exp.sol -vvv --block-gas-limit 60000000 # use gas limit control iterations

Contract

PRXVT_exp.sol

Link reference

https://x.com/CertiKAlert/status/2006685174587605315

View Gas Reports

Foundry also has the ability to report the gas used per function call which mimics the behavior of hardhat-gas-reporter. Generally speaking if gas costs per function call is very high, then the likelihood of its success is reduced. Gas optimization is an important activity done by smart contract developers.

Every poc in this repository can produce a gas report like this:

forge test --gas-report --contracts <contract> -vvv

For Example: Let us find out the gas used in the Audius poc

Execution

forge test --gas-report --contracts ./src/test/Audius.exp.sol -vvv

Demo

Bug Reproduce

Moved to DeFiVulnLabs

FlashLoan Testing

Moved to DeFiLabs

License

This project is licensed under the Apache License 2.0.

defi

ethereum

foundry

solidity

web3

Significant stargazers

(top 24 of 45)

Ben {chmark} Adams

2,035 followers · starred Sep 2023

Cong Ding

0 followers · starred May 2026

cui

178 followers · starred Oct 2024

Ori

84 followers · starred Jun 2026

Similar repos

SunWeb3Sec/DeFiVulnLabs

To learn common smart contract vulnerabilities using Foundry!

1,979

same org

pcaversaccio/reentrancy-attacks

A chronological and (hopefully) complete list of reentrancy attacks to date.

1,628

sayan011/Immunefi-bug-bounty-writeups-list

curation of all(most) immunefi bug bounty writeups I could find(till now)

1,219

OpenZeppelin/damn-vulnerable-defi

755

Web-n-Composite/crypto-hacks-list

Cryptocurrency hacks list

358

crytic/awesome-ethereum-security

A curated list of awesome Ethereum security references

1,482

OffcierCia/DeFi-Developer-Road-Map

DeFi Developer roadmap is a curated Developer handbook which includes a list of the best tools for…

10,858

bkrem/awesome-solidity

⟠ A curated list of awesome Solidity resources, libraries, tools and more

7,052

SunWeb3Sec/DeFiHackLabs

Reproduce DeFi hacked incidents using Foundry.

Solidity

6,808

3,879 commits

updated Oct 12, 2026

See the code

README

DeFi Hacks Reproduce - Foundry

Reproduce DeFi hack incidents using Foundry.

888 incidents included.

Let's make Web3 secure! Join Discord

Notion: 101 root cause analysis of past DeFi hacked incidents

Transaction debugging tools

Getting Started
Who Support Us
Donate Us
List of Past DeFi Incidents
Transaction debugging tools
Ethereum Signature Database
Useful tools
Hacks Dashboard
List of DeFi Hacks & POCs

Getting Started

Follow the instructions to install Foundry.
Clone and install dependencies:git submodule update --init --recursive
Contributing Guidelines

Web3 Cybersecurity Academy

All articles are also published on Substack.

OnChain transaction debugging

Lesson 1: Tools ( English | 中文 | Vietnamese | Korean | Spanish | 日本語 )
Lesson 2: Warm up ( English | 中文 | Korean | Spanish | 日本語 )
Lesson 3: Write Your Own PoC (Price Oracle Manipulation) ( English | 中文 | Korean | Spanish | 日本語 )
Lesson 4: Write Your Own PoC (MEV Bot) ( English | 中文 | Korean | Spanish | 日本語 )
Lesson 5: Rugpull Analysis ( English | 中文 | Spanish | 日本語 )
Lesson 6: Write Your Own PoC (Reentrancy) ( English | 中文 | Spanish | 日本語 )
Lesson 7: Hack Analysis: Nomad Bridge, August 2022 ( English | 中文 | Spanish | 日本語 )

Donate us

If you appreciate our work, please consider donating. Even a small amount helps us continue developing and improving our projects, and promoting web3 security.

Gitcoin - Donate DeFiHackLabs
EVM Chains - 0xD7d6215b4EF4b9B5f40baea48F41047Eb67a11D5
Giveth

List of Past DeFi Incidents

20261006 SetProtocol

20261006 MakerDAOFlipKeeper

20261003 MALT

20261002 GoldPesa

20261001 FlashLoopAdapter

20260930 SKYDAO

20260930 PositionManager

20260930 MUS

20260929 LPBonus

20260926 DAOstack

20260923 PancakeV3SwapHelper

20260921 DoinGud

20260921 GaslessReservoirEnabler

20260921 InternetToken

20260918 Likwid

20260916 Startale

20260916 Flamincome

20260916 PrimeFinance

20260916 Nimiq

20260915 RsETHSafeModule

20260915 BonfireSwap

20260912 SpiralHookV2

20260912 YamFinance

20260911 ORB

20260911 GDC

20260909 EtherFiAtomicQueue

20260909 OMNI404

20260909 UnifiProtocol

20260909 BeatXswap

20260909 EnsoFinance

20260909 ZentraFinance

20260908 OrderFactory

20260903 NotionalFinance

20260901 ReflexerGEB

20260831 FloatProtocol

20260831 BalancerV1BPool

20260828 AjnaFinance

20260827 CashCowCoin

20260826 EnjinCryptoItems

20260819 AllbridgeCCTP

20260809 USM

20260806 UnistreetLaunchpad

20260805 StrongBlock

20260803 AIC

20260802 MOKE

20260716 CrowdRingCircle

20260716 PerpetualProtocol

20260627 CookFinanceIssuance

20260625 LixirPermitDrain

20260625 OceanBPoolSideStaking

20260624 DLMC

20260623 RoyalRoyalties

20260622 Aztec Escape Hatch

20260614 Aztec Connect

20260609 TOPBPool

20260609 NovaBox

20260607 AmbientCrocSwapDex

20260606 BOSS

20260605 DTXT

20260605 AISOTHPresale

20260528 LegendaryMoneyMonNft

20260528 DxSale

20260527 Joe Agent

20260526 SKP Token

20260525 SquidRouterModule

20260525 New Market Trading

20260525 WUSD.fi

20260522 FractalProtocol

20260521 MureDistribution

20260515 AdsharesBridge

20260512 SQTokenStaking

20260511 INKFinance

20260511 HumaFinance

20260510 Renegade

20260507 TrustedVolumes

20260505 Ekubo

20260501 SharwaMarginTrading

20260428 RWAVault

20260428 JUDAO

20260427 Unverified_a152

20260425 SingularityDynaVault

20260423 GiddyVaultV3

20260421 KipseliPropAMM

20260420 JuiceboxREVLoans

20260420 ThetanutsVaultShareRounding

20260419 AaveRebalancerCreditDelegation

20260415 XLootStaking

20260414 MONA LisaVault

20260414 Saturn Protocol

20260412 SubQuerySettings

20260407 SquidMulticallAllowanceDrain

20260405 PerpPair

20260331 WhalebitOracleManipulation

20260328 VTSwapHook

20260327 EST Token

20260324 XocolatlLiquidator

20260324 Univ3CollateralToken

20260302 Curve LlamaLend

2025

20251020 SharwaFinance

20250830 EverValueCoin

20250827 0xf340

20250823 EquilibriaEPendle

20250823 ABCCApp

20250822 Unverified_6f7a

20250820 MulticallWithXera

20250820 0x8d2e

20250819 PresaleV5

20250817 AutoPooledTradingBot

20250816 unverified

20250816 d3xai

20250815 SizeFlashLoanLooping

20250815 PDZ

20250815 SizeCredit

20250813 BeefyZapRouter

20250813 YuliAI

20250813 coinbase

20250813 Grizzifi

20250812 BaseBebopSettlement

20250812 Bebop

20250811 WXC

20250808 ArbitrumBaseSwapper

20250805 MyCoinMaster

20250804 BscInitcodeToken

20250801 PendleReflector

20250729 AnyswapWETHPermit

20250728 SuperRare

20250728 AvaxBIFKNPair

20250726 Unverified670471

20250726 Unverified6883

20250726 MulticallWithETH

20250725 WhereIsMyDragonTreasure

20250724 SWAPPStaking

20250724 EmptySetReserve

20250721 BoJLeverageMarket

20250720 Stepp2p

20250717 unverified

20250717 WETC

20250716 StrategyLlamaLendConvex

20250716 VDS

20250713 UPENG

20250709 GMX

20250705 ActivePoolScrvUsd

20250705 Unverified_54cd

20250705 RANT

20250702 FPC

20250702 ActivePoolUrgentRedemption

20250629 Stead

20250628 InitcodeFactoryFees

20250626 ResupplyFi

20250625 Unverified_b5cb

20250625 SiloFinance

20250625 ParaSwapDAIApproval

20250623 GradientMakerPool

20250620 TokenVault

20250620 HoldSafe

20250620 Gangsterfinance

20250619 SinstakeZombie

20250619 BasePricePool

20250619 BankrollStack

20250619 BankrollNetwork

20250618 BankrollStackPlus

20250617 MetaPool

20250615 WaleCoin

20250615 FixedTokenBSwap

20250614 TSAggregatorGeneric

20250612 AAVEBoost

20250610 unverified_8490

20250609 BitCrown

20250608 TokenFactory

20250603 PegaBall

20250531 DogeAlliance

20250528 Corkprotocol

20250528 Unverified_91a1

20250527 UsualMoney

20250526 YDT

20250525 Unverified_0000

20250509 Nalakuvara_LotteryTicket50

20250427 multitransferswap

20250427 AventaRewardClaim

20250426 Lifeprotocol

20250411 Unverified 0x6077

20250311 ZeroExSettler

20250305 1inch Fusion V1 Settlement

20250304 Pump

20250227 Venus_ZKSync

20250226 HenloKart

20250224 INVISTECH

20250223 HegicOptions

20250222 Unverified_35bc

20250221 StepHeroNFTs

20250221 Bybit

20250215 unverified_d4f1

20250211 Scorch

20250211 LimitOrderProtocol

20250211 FourMeme

20250208 GMT7

20250208 Peapods Finance

20250201 GoldReserve

20250128 MCAI

20250126 AIXBTForcedSwap

20250111 RoulettePotV2

2024

20241120 MainnetSettler

20241119 PolterFinance

20241026 CompoundFork

20241022 Erc20transfer

20240926 Bedrock_DeFi

20240924 MARA

20240923 PestoToken

20240923 Bankroll_Network

20240920 DOGGO

20240920 Shezmu

20240918 Unverified_766a

20240915 WXETA

20240913 Unverified_5697

20240913 OTSeaStaking

20240912 Unverified_03f9

20240911 INUMI

20240911 INUMI_db27

20240911 AIRBTC

20240910 Caterpillar_Coin_CUT

20240905 Unverified_a89f

20240905 PLN

20240905 HANAToken

20240904 Unverified_16d0

20240903 Penpiexyz_io

20240902 Pythia

20240828 Unverified_667d

20240828 AAVE

20240820 COCO

20240816 Zenterest

20240816 OMPxContract

20240724 Spectra_finance

20240723 MEVbot_0xdd7c

20240716 Lifiprotocol

20240703 UnverifiedContr_0x452E25

20240610 UwuLend - Price Manipulation

20240531 Liquiditytokens

20240531 MixedSwapRouter

20240529 SCROLL

20240529 MetaDragon

20240528 Tradeonorion

20240514 Sonne Finance

20240514 PredyFinance

20240419 HedgeyFinance

20240417 UnverifiedContr_0x00C409

20240416 SATX

20240416 MARS_DEFI

20240415 GFA

20240415 ChaingeFinance

20240402 HoppyFrogERC

20240401 ATM

20240401 OpenLeverage

20240228 SMOOFSStaking

20240223 Zoomer

20240223 CompoundUni

20240223 BlueberryProtocol

20240222 SwarmMarkets

20240216 ParticleTrade

20240129 PeapodsFinance

20240128 BarleyFinance

20240127 CitadelFinance

20240125 NBLGAME

20240122 DAO_SoulMate

20240117 BmiZapper

20240117 SocketGateway

20240115 Shell_MEV_0xa898

20240102 RadiantCapital

20240101 OrbitChain

2023

20231231 Channels BUSD&USDC

20231230 ChannelsFinance

20231228 CCV

20231228 DominoTT

20231225 Telcoin

20231222 PineProtocol

20231220 TransitFinance

20231217 Bob

20231217 FloorProtocol

20231211 GoodCompound

20231209 BCT

20231207 HNet

20231206 TIME

20231206 ElephantStatus

20231205 MAMO

20231205 BEARNDAO

20231202 bZxProtocol

20231201 UnverifiedContr_0x431abb

20231130 EEE

20231130 CAROLProtocol

20231117 Token8633_9419

20231106 TheStandard_io

20231106 KR

20231102 BRAND

20231102 3913Token

20231101 SwampFinance

20231101 OnyxProtocol

20231031 UniBotRouter

20231030 LaEeb

20231028 AstridProtocol

20231024 MaestroRouter2

20231022 OpenLeverage

20230930 FireBirdPair

20230818 ExactlyProtocol

20230814 ZunamiProtocol

20230809 EarningFram

20230802 CurveBurner

20230802 Uwerx

20230801 NeutraFinance

20230723 MintoFinance

20230722 ConicFinance02

20230721 ConicFinance

20230715 USDTStakingContract28

20230712 Platypus

20230712 WGPT

20230711 RodeoFinance

20230704 BaoCommunity

20230627 UnverifiedContr_9ad32

20230627 STRAC

20230623 SHIDO

20230621 BabyDogeCoin02

20230621 BUNN

20230620 MIM

20230619 Contract_0x7657

20230618 ARA

20230617 MidasCapitalXYZ

20230617 Pawnfi

20230615 CFC

20230615 DEPUSDT_LEVUSDC

20230612 Sturdy Finance

20230611 SellToken04

20230607 CompounderFinance

20230606 VINU

20230606 UN

20230602 NST SimpleSwap

20230601 DDCoin

20230601 Cellframenet

20230531 ERC20TokenBank

20230529 Jimbo

20230529 BabyDogeCoin

20230415 HundredFinance

20230413 yearnFinance

20230328 SafeMoon Hack

20230328 THENA

20230325 DBW

20230322 BIGFI

20230317 ParaSpace NFT

20230315 Poolz

20230313 EulerFinance

20230218 RevertFinance

20230217 Starlink

20230217 Dexible

20230217 Platypusdefi

20230203 Orion Protocol

20230203 Spherax USDs

20230202 BonqDAO

20230130 BEVO

20230126 TomInu Token

20230119 SHOCO Token

20230119 ThoreumFinance

20230118 QTN Token

20230118 UPS Token

20230117 OmniEstate

20230116 MidasCapital

2022

20221211 MEVbot_0x28d9

20221119 AnnexFinance

20221027 Team Finance

20221026 N00d Token

20221025 ULME

20221024 Market

20221024 MulticallWithoutCheck

20221021 OlympusDAO

20221020 HEALTH Token

20221014 EFLeverVault

20221014 MEVBOT a47b

20221012 ATK

20221011 Rabby Wallet SwapRouter

20221011 Templedao

20221010 Carrot

20221009 Xave Finance

20221006 RES-Token

20221002 Transit Swap

20221001 BabySwap

20221001 RL

20221001 Thunder Brawl

20220929 BXH

20220928 MEVBOT Badc0de

20220923 RADT-DAO

20220913 MevBot Private TX

20220909 DPC

20220908 YYDS

20220908 NewFreeDAO

20220908 Ragnarok Online Invasion

20220906 NXUSD

20220905 ZoomproFinance

20220902 ShadowFi

20220902 Bad Guys by RPF

20220828 DDC

20220824 LuckyTiger NFT

20220816 Circle_2

20220813 Circle

20220810 XSTABLE Protocol

20220802 Nomad Bridge

20220801 Reaper Farm

20220725 LPC

20220723 Audius

20220713 SpaceGodzilla

20220710 Omni NFT

20220706 FlippazOne NFT

20220701 Quixotic - Optimism NFT Marketplace

20220626 XCarnival

20220624 Harmony's Horizon Bridge

20220618 SNOOD

20220616 InverseFinance

20220608 GYMNetwork

20220608 Optimism - Wintermute

20220606 Discover

20220529 NOVO Protocol

20220524 HackDao

20220517 ApeCoin

20220508 Fortress Loans

20220430 Saddle Finance

20220430 Rari Capital/Fei Protocol

20220428 DEUS DAO

20220424 Wiener DOGE

20220423 Akutar NFT

20220421 Zeed Finance

20220416 BeanstalkFarms

20220415 Rikkei Finance

20220412 ElephantMoney

20220411 Creat Future

20220409 GYMNetwork

20220329 Ronin Network

20220329 Redacted Cartel

20220327 Revest Finance

20220326 Auctus

20220322 CompoundTUSDSweepTokenBypass

20220321 OneRing Finance

20220320 LI.FI

20220320 Umbrella Network

20220315 Agave Finance

20220315 Hundred Finance

20220313 Paraluni

20220309 Fantasm Finance

20220305 Bacon Protocol

20220303 TreasureDAO

20220214 BuildFinance - DAO

20220208 Sandbox LAND

20220205 Meter

20220204 TecraSpace

20220128 Qubit Finance

20220118 Multichain (Anyswap)

2021

20211221 Visor Finance

20211218 Grim Finance

20211214 Nerve Bridge

20211130 MonoX Finance

20211123 Ploutoz Finance

20211027 Cream Finance

20211015 Indexed Finance

20210916 SushiSwap Miso

20210915 Nimbus Platform

20210915 NowSwap Platform

20210912 ZABU Finance

20210903 DAO Maker

20210830 Cream Finance

20210817 XSURGE

20210811 Poly Network

20210804 WaultFinance

20210804 Popsicle

20210728 Levyathan Finance

20210710 Chainswap

20210702 Chainswap

20210628 SafeDollar

20210625 xWin Finance

20210622 Eleven Finance

20210607 88mph NFT

20210603 PancakeHunny

20210527 JulSwap

20210527 BurgerSwap

20210519 PancakeBunny

20210516 bEarn

20210508 Rari Capital

20210305 Paid Network

20210204 Yearn YDai

20210125 Sushi Badger Digg

Before 2020

20201229 Cover Protocol

20201121 Pickle Finance

20201026 Harvest Finance

20200912 bzx

20200804 Opyn Protocol

20200628 Balancer Protocol

20200618 Bancor Protocol

20180422 Beauty Chain

20171106 Parity - 'Accidentally Killed It'

20170719 Parity Multisig

Transaction debugging tools

Ethereum Signature Database

4byte | sig db | etherface

Useful tools

ABI to interface | Get ABI for unverified contracts | ETH Calldata Decoder | ETHCMD - Guess ABI | Abi tools

Hacks Dashboard

List of DeFi Hacks & POCs

forge test --contracts src/test/2026-10/SetProtocol_exp.sol --evm-version cancun -vvv

Contract

SetProtocol_exp.sol

20261006 MakerDAOFlipKeeper - the dormant ETH-A flip-keeper proxy's drain selector has no ds-auth check, so anyone can call it to make the keeper vat.hope() a caller-supplied worker and then deal its four undealt 2020 ETH-A auctions and flux/exit the freed 200 WETH of collateral out

Lost: exactly 200 ETH (200.000000000000000000 WETH, 0xad78ebc5ac6200000 wei, reproduced with zero variance) to a fresh attacker on Ethereum; the dormant keeper proxy's unprotected drain settled its four undealt 2020 ETH-A liquidation auctions (#1457-1460, 50 WETH each) and swept the freed collateral out - not a MakerDAO core bug, the keeper impl's drain selector simply omits the ds-auth modifier that the contract's other functions carry

forge test --contracts src/test/2026-10/MakerDAOFlipKeeper_exp.sol -vvv

Contract

MakerDAOFlipKeeper_exp.sol

20261003 MALT - the MALT/DAI sLP runs its below-peg price recovery inside swap() before sending the output, pulling DAI from the Capital Source treasury into the pool, then checks its constant-product invariant against the final balances without separating the injected treasury DAI from the caller's own input, so a negligible 1 DAI swap is credited with thousands of injected DAI and releases a disproportionate MALT output

Lost: 13,440.581562307921517594 DAI net profit to the attacker (exactly reproduced) on Polygon; the Capital Source treasury was drained of 12,744.644506590589136718 DAI across two below-peg rebalance injections, the attacker paying just 1 DAI per exploit swap and arbitraging the extracted MALT out on QuickSwap - the ~$72K figure in the original alert does not match the on-chain reconstruction

forge test --contracts src/test/2026-10/MALT_exp.sol -vvv

Contract

MALT_exp.sol

20261002 GoldPesa - the GPX V4 hook rebalances protocol liquidity inside beforeSwap via a burn and TAKE_PAIR that run in the attacker's own open PoolManager unlock, and never checks the PositionManager deltas are settled first, so an unsettled mint debt parked in the same unlock nets against the hook's burn credit and the attacker walks the freed USDC out

Lost: 114,999.999186 USDC (exactly reproduced) on Base; the GPX/USDC V4 pool's protocol liquidity was burned by the hook's own hourly rebalance, and its 148,868.602188 USDC burn credit was split by the shared-unlock delta bug - 33,868.603002 USDC reached the hook while 114,999.999186 USDC paid off the attacker's unsettled mint debt and then exited to the attacker, funded by a 175,000 USDC Morpho flash loan repaid in the same tx

forge test --contracts src/test/2026-10/GoldPesa_exp.sol --evm-version cancun -vvv

Contract

GoldPesa_exp.sol

20261001 FlashLoopAdapter - a Safe module authenticates its caller by asking that caller whether the module is enabled (self-attestation) and then makes an unconstrained call to a caller-supplied router, letting a fake Safe drive the adapter into draining real Safes that enabled it

Lost: 114.096151 WETH (~$305k, exactly reproduced) on Ethereum; two Safes that enabled the module as a victim were emptied - Safe #1 lost 1306.48 weETH of Aave collateral once its 1335.26 WETH debt was repaid, Safe #2 lost 6.426 weETH, all swapped to WETH via ODOS for the attacker's net

forge test --contracts src/test/2026-10/FlashLoopAdapter_exp.sol --evm-version cancun -vvv

Contract

FlashLoopAdapter_exp.sol

20260930 SKYDAO - sell-path controller burns the pair's SKYDAO and syncs before the net sell is credited, latching a near-zero reserve that a direct pair.swap drains for the pair's entire USDT

Lost: 59,914.12 USDT net to the attacker (exactly reproduced) on BNB Chain; the SKYDAO/USDT PancakeSwap V2 pair lost its entire 183,482.88 USDT reserve, drained by a direct pair.swap against the reserve the sell-path burn+sync latched to ~0

forge test --contracts src/test/2026-09/SKYDAO_exp.sol --evm-version cancun -vvv

Contract

SKYDAO_exp.sol

20260930 PositionManager - deposit values the vault's existing USDT at the manipulable PancakeSwap V3 spot price, so crashing the spot before depositing mints inflated shares that withdraw redeems in the same transaction

Lost: 32,080.604282 USDT (exactly reproduced) on BNB Chain; one atomic tx crashed the USDT/BTCB spot with an 8,000,000 USDT swap, then ran 24 deposit(1,000,000 USDT)/withdraw cycles to drain the vault's own PancakeSwap V3 position, the pool losing 32,096.098596 USDT

forge test --contracts src/test/2026-09/PositionManager_exp.sol -vvv

Contract

PositionManager_exp.sol

20260930 MUS - deposit refunds a first-deposit bonus and also credits it as withdrawable allocation, so a single deposit-withdraw from a fresh address returns more ETH than deposited

Lost: ~0.400168 ETH per deposit-withdraw cycle (exactly reproduced) on Ethereum; the MUS pool's standing 5.335 ETH was drained to 0 across the attack block, reported campaign total ~$36.9k across many fresh addresses

forge test --contracts src/test/2026-09/MUS_exp.sol -vvv

Contract

MUS_exp.sol

20260929 LPBonus - reserve inconsistency between reward accrual and LP withdrawal lets a manipulated MSN reserve inflate an LP reward claim

Lost: 92,607 USDT ($92.6k) on BNB Chain; one LP position claimed 1,442,165.713011 FIST against an accrual that funded ~940,041.612768 FIST, extracted by flash-swapping the MSN reserve down at accrual and back up at withdrawal

forge test --contracts src/test/2026-09/LPBonus_exp.sol -vvv

Contract

LPBonus_exp.sol

20260926 DAOstack - permissionless newOrganization lets an attacker hijack an existing Reputation contract and drain the Avatar

Lost: 4.025 ETH (full Genesis Alpha treasury); attacker minted 20,000 REP against the victim's real Reputation contract (supply 9,738.6 to 29,738.6, ~67% majority after a 200 REP GenesisProtocol vote-cost burn) and used it to self-install as a full-permission scheme

forge test --contracts src/test/2026-09/DAOstack_exp.sol -vvv

Contract

DAOstack_exp.sol

20260923 PancakeV3SwapHelper - Signed Swap Delta Accounting Error

Lost: 1.6488688845 BNB ($1.3K)

BSC_RPC=https://bsc-mainnet.public.blastapi.io forge test --contracts ./src/test/2026-09/PancakeV3SwapHelper_exp.sol -vvv --evm-version shanghai

Contract

PancakeV3SwapHelper_exp.sol

Link reference

https://bscscan.com/tx/0x70bc4ff8439f74d26d454a53e9a135ac3659a958aa3462218d0db7ed55cf5104

20260921 DoinGud - acceptOffer replay via missing offer cleanup on the amount=0 path

Lost: 35,380.154566 USDC net (two byte-identical acceptOffer calls each paid out 35,486.935717 USDC from escrow; funded via a UniV2 flash swap, repaid 35,593.716868 USDC)

forge test --contracts src/test/2026-09/DoinGud_exp.sol -vvv

Contract

DoinGud_exp.sol

20260921 GaslessReservoirEnabler - erc20WithTransfersAndExecute lets a whitelisted module run unvalidated transferFrom calldata

Lost: 8.72 WETH ($23.8K) across 466 victims with standing approvals to the Enabler; PoC reproduces 3 victims, 2.3546 WETH ($6.4K, ~27% of the WETH-leg loss)

forge test --contracts src/test/2026-09/GaslessReservoirEnabler_exp.sol -vvv

Contract

GaslessReservoirEnabler_exp.sol

20260921 InternetToken - permissionless swapV3 with caller-supplied pool lets a fake callback mint INT arbitrarily

Lost: 764,145,702 INT + 5.846988 WETH (attacker minted 925.41M INT total, dumped 161.27M into the real INT/WETH pool for the WETH, reproduced to the wei)

forge test --contracts src/test/2026-09/InternetToken_exp.sol -vvv

Contract

InternetToken_exp.sol

20260918 Likwid - missing pairDelta update in leverage=0 margin borrow freezes AMM quote

Lost: 74.31 BNB (reproduced to within 3 wei)

BSC_RPC=https://bsc-mainnet.public.blastapi.io forge test --contracts src/test/2026-09/Likwid_exp.sol -vvv

Contract

Likwid_exp.sol

20260916 Startale - transient storage init flag outlives the constructor and lets anyone reinitialize an ERC7579 account and drain it

Lost: 427.551160 USDC drained in this batch tx (32.555561 USDC reproduced across 3 of 23 victim accounts; ~$2,876 USDC+USDT aggregate across 41 known batches)

forge test --contracts src/test/2026-09/Startale_exp.sol -vvv

Contract

Startale_exp.sol

20260916 Flamincome - permissionless Convex stakeFor inflates Strategy NAV and lets VaultYUSDT overpay on withdrawAll

Lost: ~$345.9K USDT net attacker profit (gross Strategy loss ~$595K in aUSDT+USDT)

forge test --contracts src/test/2026-09/Flamincome_exp.sol -vvv

Contract

Flamincome_exp.sol

20260916 PrimeFinance - permissionless stale signed oracle report overwrite drains lending pool

Lost: 425.5 WHYPE ($33.4K) drained from the lending pool reserve

forge test --contracts src/test/2026-09/PrimeFinance_exp.sol -vvv

Contract

PrimeFinance_exp.sol

20260916 Nimiq - GSN forwarder skips signature check, relying solely on attacker-chosen paymaster

Lost: ~$50,463.79 (USDC, USDT0, USDC.e drained from a swap-liquidity wallet's standing approvals)

forge test --contracts src/test/2026-09/Nimiq_exp.sol -vvv

Contract

Nimiq_exp.sol

20260915 RsETHSafeModule - nested self-referential multicall authorization bypass drains Gnosis Safe via DELEGATECALL

Lost: 2,900 aEthrsETH (~$7.8M gross; 2,882.37 rsETH / ~$7.73M net to the MEV frontrunner)

forge test --contracts src/test/2026-09/RsETHSafeModule_exp.sol -vvv

Contract

RsETHSafeModule_exp.sol

20260915 BonfireSwap - missing caller authorization lets anyone force-sell any approved holder's tokens

Lost: 66 BNB ($47-50K); 58.78 BNB reproduced from a 5-victim subset (~98.7% of tokens drained)

forge test --contracts src/test/2026-09/BonfireSwap_exp.sol -vvv

Contract

BonfireSwap_exp.sol

20260912 SpiralHookV2 - Uniswap V4 spot-price borrow plus tx.origin-keyed same-block guard bypass

Lost: ~10.70728 ETH (reproduced exact to the wei)

forge test --contracts src/test/2026-09/SpiralHookV2_exp.sol --evm-version cancun -vvv

Contract

SpiralHookV2_exp.sol

20260912 YamFinance - dormant-DAO quorum governance takeover drains legacy UMA farming contracts

Lost: ~$121K (48.085 WETH + 763.101 UMA)

forge test --contracts src/test/2026-09/YamFinance_exp.sol -vvv

Contract

YamFinance_exp.sol

20260911 ORB - leveraged pool buyout + refund-before-sell reentrancy drains burnLP-depleted reserve

Lost: 44.9-45 BNB ($32,610.72)

forge test --contracts src/test/2026-09/ORB_exp.sol -vvv --evm-version cancun

Contract

ORB_exp.sol

20260911 GDC - chained EOA bypass, liquidity misclassification, burn mismatch, and reentrant tax-free exit

Lost: ~35.34 BNB (35.337151495976986490 BNB reproduced exact to the wei)

forge test --contracts src/test/2026-09/GDC_exp.sol -vvv

Contract

GDC_exp.sol

20260909 EtherFiAtomicQueue - missing solver access control drains victim allowances

Lost: ~15.45 ETH (9 real victims' standing liquidETH allowances drained)

forge test --contracts src/test/2026-09/EtherFiAtomicQueue_exp.sol -vvv

Contract

EtherFiAtomicQueue_exp.sol

20260909 OMNI404 - ERC-404 dual ID/amount transfer interpretation drains pool WETH

Lost: 2.427 WETH (run() leg reproduced here; ~3.02 ETH across the full 4-tx block)

forge test --contracts src/test/2026-09/OMNI404_exp.sol -vvv

Contract

OMNI404_exp.sol

20260909 UnifiProtocol - unregistered caller-supplied pool trusted for reward eligibility and math

Lost: ~5.86 BNB (treasury still holds ~9.17 BNB, contract unpaused — bug remains re-exploitable)

forge test --contracts src/test/2026-09/UnifiProtocol_exp.sol -vvv

Contract

UnifiProtocol_exp.sol

20260909 BeatXswap - slot0 spot-price oracle with no TWAP guard drains vesting BTX reserves

Lost: ~$63.7K USDT net profit (2,984,557 BTX / ~$77.5K drained from two vesting reserves)

forge test --contracts src/test/2026-09/BeatXswap_exp.sol -vvv

Contract

BeatXswap_exp.sol

20260909 EnsoFinance - short-window Uniswap V3 TWAP oracle enables ~9x overvalued strategy deposit

Lost: ~5.6 ETH (5.277 ETH realized in this PoC after slippage selling looted UNI/AAVE/MKR back to WETH)

forge test --contracts src/test/2026-09/EnsoFinance_exp.sol -vvv

Contract

EnsoFinance_exp.sol

20260909 ZentraFinance - aToken burn safeguard clamps to zero, repayWithATokens clears debt without burning

Lost: 140,000 ctUSD + 30 USDC.e ($143K)

forge test --contracts src/test/2026-09/ZentraFinance_exp.sol -vvv

Contract

ZentraFinance_exp.sol

20260908 OrderFactory - missing access control on createOrderForBuyer drains buyer accounts

Lost: ~20.247 ETH this tx (5 buyers drained; reported incident total ~24.7 ETH)

forge test --contracts src/test/2026-09/OrderFactory_exp.sol -vvv

Contract

OrderFactory_exp.sol

20260907 RouterDrain - permissionless swap entry lets a fake V3 pool abuse router allowances

Lost: ~62.28 WBNB across 29 victims (3 reconstructed here: OCEAN, Kandura, SATURN)

forge test --contracts src/test/2026-09/RouterDrain_exp.sol -vvv

Contract

RouterDrain_exp.sol

20260907 CozyFinance - unverified UMA Optimistic Oracle trigger enables unbacked protection-token redemption

Lost: 160,776 USDC.e ($160K)

forge test --contracts src/test/2026-09/CozyFinance_exp.sol -vvv

Contract

CozyFinance_exp.sol

20260905 DHC - repeatable claim due to missing claimed-flag

Lost: ~$71.8K USDT

forge test --contracts src/test/2026-09/DHC_exp.sol -vvv

Contract

DHC_exp.sol

Lost: ~9.25 ETH

forge test --contracts src/test/2026-09/Reddio_exp.sol -vvv

Contract

Reddio_exp.sol

20260905 SecuredFi - same-block self-trade manipulates getMarketUnitPrice to fabricate collateral

Lost: 0.9 WBTC ($72K single-drain; ~$104K across all actors exploiting the same public bug)

forge test --contracts src/test/2026-09/SecuredFi_exp.sol -vvv

Contract

SecuredFi_exp.sol

20260903 NotionalFinance - ERC1155 fCash mint overflow drains escrow

Lost: ~69,257.37 DAI + 1,658,524.86 USDC ($1.73M)

forge test --contracts src/test/2026-09/NotionalFinance_exp.sol -vvv

Contract

NotionalFinance_exp.sol

20260901 ReflexerGEB - Shared GebProxyActions library registered as SAFE owner

Lost: 5.9436 ETH ($14K, drained from 4 SAFEs in one tx: IDs 3, 5, 8, 18)

forge test --contracts src/test/2026-08/ReflexerGEB_exp.sol -vvv

Contract

ReflexerGEB_exp.sol

20260831 FloatProtocol - Uniswap V3 spot price manipulation of Hypervisor LP shares

Lost: ~$28,000 (10.71 ETH)

forge test --contracts src/test/2026-08/FloatProtocol_exp.sol -vvv

Contract

FloatProtocol_exp.sol

20260831 BalancerV1BPool - joinswapPoolAmountOut rounding drain across 5 pools

Lost: $110,839 for this DPI/USDC/WETH/WBTC pool ($234K aggregate across all 5 vulnerable pools)

forge test --contracts src/test/2026-08/BalancerV1BPool_exp.sol -vvv

Contract

BalancerV1BPool_exp.sol

20260828 AjnaFinance - liquidation accounting manipulation via self-controlled auction

Lost: ~$124.8K for this cbETH pool (1 of 7 pools hit by the same bug the same day, ~$775K aggregate)

forge test --contracts src/test/2026-08/AjnaFinance_exp.sol -vvv

Contract

AjnaFinance_exp.sol

20260827 CashCowCoin - privileged burn + premature sync() drains PancakeSwap pair

Lost: 165.47 WBNB ($117.4K)

forge test --contracts src/test/2026-08/CashCowCoin_exp.sol --evm-version cancun -vvv

Contract

CashCowCoin_exp.sol

20260826 EnjinCryptoItems - unprotected registry reinitialization, manager takeover

Lost: 5,231,353 ENJ (~$142K)

forge test --contracts src/test/2026-08/EnjinCryptoItems_exp.sol -vvv

Contract

EnjinCryptoItems_exp.sol

20260825 FHToken - sell-tax reserve mismatch via premature sync()

Lost: 19,999.018106552928530404 USDT (~$20K)

forge test --contracts src/test/2026-08/FHToken_exp.sol --evm-version cancun -vvv

Contract

FHToken_exp.sol

20260823 ArrakisGUNI - Uniswap V3 spot-price manipulation of vault mint/burn

Lost: ~2.9414 ETH net attacker surplus (Arrakis V1 / G-UNI ENS-WETH vault)

forge test --contracts src/test/2026-08/ArrakisGUNI_exp.sol -vvv

Contract

ArrakisGUNI_exp.sol

20260823 TermFinance - Governance capture via thinly-wrapped Aragon voting power

Lost: 2,841.743535791961701401 WETH (attacker net gain, ETH meta-vault)

forge test --contracts src/test/2026-08/TermFinance_exp.sol -vvv

Contract

TermFinance_exp.sol

20260822 SandboxOFT - LayerZero delegate hijack via approveAndCall

Lost: 10,000,000 SAND minted unbacked (~$517,170 face value, one of 400+ repeated txs in an ongoing campaign)

forge test --contracts src/test/2026-08/SandboxOFT_exp.sol -vvv

Contract

SandboxOFT_exp.sol

20260819 AllbridgeCCTP - Phantom deposit via unverified message attestation

Lost: ~189,751.554381 USDC

forge test --contracts src/test/2026-08/AllbridgeCCTP_exp.sol --evm-version cancun -vvv

Contract

AllbridgeCCTP_exp.sol

20260809 USM - defund() price split-invariance rounding exploit

Lost: ~70.83 ETH

forge test --contracts src/test/2026-08/USM_exp.sol -vvv

Contract

USM_exp.sol

20260806 UnistreetLaunchpad - arbitrary call injection via unvalidated launch forwarding

Lost: ~17,743.91 USDC + 0.0072 WETH ($17.75K)

forge test --contracts src/test/2026-08/UnistreetLaunchpad_exp.sol -vvv

Contract

UnistreetLaunchpad_exp.sol

20260805 StrongBlock - governance takeover of an abandoned Governor

Lost: 32,695.761681 STRONG + 383,447.167299 STRNGR (~$72K)

forge test --contracts src/test/2026-08/StrongBlock_exp.sol -vvv

Contract

StrongBlock_exp.sol

20260803 AIC - pair skim / reserve-mismatch exploit, flash-swap leveraged

Lost: 32.36 BNB ($21.5K)

forge test --contracts src/test/2026-08/AIC_exp.sol -vvv

Contract

AIC_exp.sol

20260802 MOKE - settle() tx.origin check lets any EOA latch a manipulated MOKE/USDT price, then claim() mints inflated MOKE against it

Lost: ~1546.54 BNB (~41.68M MOKE over-minted)

forge test --contracts src/test/2026-10/MOKE_exp.sol --evm-version prague -vvv

Contract

MOKE_exp.sol

20260716 CrowdRingCircle - sell-destroy path burns CRC out of the pair on any non-exempt sell, collapsing the reserve so a follow-up swap drains the pool's USDT

Lost: ~201.36K USDT

forge test --contracts src/test/2026-10/CrowdRingCircle_exp.sol -vvv

Contract

CrowdRingCircle_exp.sol

20260716 PerpetualProtocol - v2 (Curie) unguarded OrderBook funding-growth update lets anyone poison cached funding, draining the Vault

Lost: ~3,062.21 USDC

forge test --contracts src/test/2026-10/PerpetualProtocol_exp.sol --evm-version cancun -vvv

Contract

PerpetualProtocol_exp.sol

20260706 SummerFi - FleetCommander NAV Inflation via Depegged xUSD

Lost: ~$6M (DAI + LVUSDC shares)

forge test --contracts ./src/test/2026-07/SummerFi_exp.sol -vvv --evm-version cancun

Contract

SummerFi_exp.sol

Link reference

https://etherscan.io/tx/0x0db528c44f23fc7fa4544684a2fab81096450a14aae8bc89f42cd0592d43da12

20260701 edel-xstock - Price Oracle Manipulation

Lost: 204,215.57 USDC

forge test --contracts ./src/test/2026-07/edel-xstock_exp.sol -vvv

Contract

edel-xstock_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2072130807356129726

20260629 Vault4626 - Business Logic Flaw

Lost: 13.53 WETH

forge test --contracts ./src/test/2026-06/Vault4626_exp.sol --evm-version shanghai -vvv

Contract

Vault4626_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2071495744071086510

20260628 AIDC - Business Logic Flaw

Lost: 220.13 WBNB

forge test --contracts ./src/test/2026-06/AIDC_exp.sol -vvv --evm-version shanghai

Contract

AIDC_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2071415914948685892

20260627 CookFinanceIssuance - Price Oracle Manipulation

Lost: ~$50K

forge test --contracts ./src/test/2026-06/CookFinanceIssuance_exp.sol -vvv --evm-version shanghai

Contract

CookFinanceIssuance_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2071497001443770684

20260625 LixirPermitDrain - Broken Signature Verification

Lost: 2.60 ETH, 4,477.72 USDC, 3,609.95 USDT, 24,182.56 LIX

forge test --contracts ./src/test/2026-06/LixirPermitDrain_exp.sol -vvv

Contract

LixirPermitDrain_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2070362661691207935

20260625 OceanBPoolSideStaking - BPool single-sided join/exit math with SideStaking gulp accounting

Lost: 127.86K mOCEAN

forge test --contracts ./src/test/2026-06/OceanBPoolSideStaking_exp.sol -vvv

Contract

OceanBPoolSideStaking_exp.sol

Link reference

http://x.com/defimonalerts/status/2070362661540286735

20260624 DLMC - Reserve-derived livePrice manipulation

Lost: 222,560.22 USDT

forge test --contracts ./src/test/2026-06/DLMC_exp.sol -vvv --evm-version cancun

Contract

DLMC_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2069957542109958498

20260623 RoyalRoyalties - Zero-amount ERC1155 batch transfer inflated Royal LDA tier balance

Lost: 261,162.93 USDC

forge test --contracts ./src/test/2026-06/RoyalRoyalties_exp.sol -vvv

Contract

RoyalRoyalties_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2069596801725002121

20260622 Aztec Escape Hatch - proof_id Accounting Bypass (whitehat reproduction)

Lost: N/A (purely educational; worst-case impact would have been ~$2M, matching the separate vulnerability that actually drained the contracts)

forge test --contracts src/test/2026-06/AztecEscapeHatch_exp2.sol -vvv

Contract

AztecEscapeHatch_exp2.sol

Link reference

https://github.com/AztecProtocol/aztec-2.0

https://x.com/ivanbogatyy/status/2069159603942596830

20260622 ATM - LP Token Burn

Lost: 1,603.99 WBNB

forge test --contracts ./src/test/2026-06/ATM_LP_Burn_exp.sol -vvv --evm-version shanghai

Contract

ATM_LP_Burn_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2068993748936151209

20260620 OLPC - OLPC pair reserve manipulation

Lost: 1,115,903.66 USDT

forge test --contracts ./src/test/2026-06/OLPC_exp.sol --evm-version shanghai -vvv

Contract

OLPC_exp.sol

Link reference

https://x.com/exvulsec/status/2068308334512365924

20260618 JB - JB helper repeated cycle drains JB/USDT pair

Lost: 49,958.06 USDT

forge test --contracts ./src/test/2026-06/JB_exp.sol -vvv --evm-version cancun

Contract

JB_exp.sol

Link reference

https://x.com/audit_911/status/2067943961327763788

20260617 Aztec V1 - escapeHatch Proof-Forgery (permissionless RollupProcessor exit)

Lost: ~$2.2M (1158 ETH + 150,000 DAI + 0.4696 renBTC)

forge test --contracts src/test/2026-06/AztecEscapeHatch_exp.sol -vvv

Contract

AztecEscapeHatch_exp.sol

20260617 WHALE - Transfer Accounting Reserve Desync

Lost: 3,460.41 USDT

forge test --contracts ./src/test/2026-06/WHALE_exp.sol -vvv --evm-version cancun

Contract

WHALE_exp.sol

Link reference

https://x.com/audit_911/status/2067451654694412720

20260617 LBP - LBP balanceOf reward accounting

Lost: 610.56 BNB

forge test --contracts ./src/test/2026-06/LBP_exp.sol -vvv --evm-version cancun

Contract

LBP_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2067329401977532429

20260616 DIP - Fee-on-Transfer Reserve Manipulation

Lost: 111,097.59 USDC

forge test --contracts ./src/test/2026-06/DIP_exp.sol -vvv --evm-version shanghai

Contract

DIP_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2067059314519417163

Lost: 105471.50 USDC

forge test --contracts ./src/test/2026-06/Thetanuts_exp.sol -vvv

Contract

Thetanuts_exp.sol

Link reference

https://x.com/PeckShieldAlert/status/2066540451126190312

20260614 Aztec Connect - numRealTxs Proof/Settlement Mismatch (permissionless RollupProcessorV3)

Lost: ~$2.19M (this PoC reproduces the 908.99 ETH leg)

forge test --contracts src/test/2026-06/AztecConnect_exp.sol -vvv

Contract

AztecConnect_exp.sol

Link reference

https://www.cryptotimes.io/2026/06/15/aztec-exploit-drains-2-19m-from-dormant-privacy-protocol/

https://dev.to/cryip/how-a-single-validation-mismatch-can-drain-millions-lessons-from-the-aztec-connect-exploit-2598

20260609 TOPBPool - Governance-controlled token mint and Balancer pool drain

Lost: 944.20 WETH

forge test --contracts ./src/test/2026-06/TOPBPool_exp.sol -vvv

Contract

TOPBPool_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2064616112822583505

20260609 NovaBox - Constructor Dividend Checkpoint Bypass

Lost: 56.73 ETH

forge test --contracts ./src/test/2026-06/NovaBox_exp.sol --evm-version prague -vvv

Contract

NovaBox_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2064616360466919793

20260607 AmbientCrocSwapDex - Native surplus accounting flaw

Lost: 67.85 ETH

forge test --contracts ./src/test/2026-06/AmbientCrocSwapDex_exp.sol -vvv

Contract

AmbientCrocSwapDex_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2063816231023427861

20260606 BOSS - BOSS helper mint/burn and transfer-tax pool skew

Lost: 10,207.54 USDT

forge test --contracts ./src/test/2026-06/BOSS_exp.sol -vvv --evm-version shanghai

Contract

BOSS_exp.sol

Link reference

https://x.com/audit_911/status/2063819348305985748

20260605 DTXT - Liquidity Misclassification Fee Bypass

Lost: 35,041.11 USDT

forge test --contracts ./src/test/2026-06/DTXT_exp.sol -vvv --evm-version shanghai

Contract

DTXT_exp.sol

Link reference

https://x.com/audit_911/status/2063793931138347015

20260605 AISOTHPresale - Fixed-price presale arbitrage

Lost: 30,314.76 USDT

forge test --contracts ./src/test/2026-06/AISOTHPresale_exp.sol -vvv --evm-version shanghai

Contract

AISOTHPresale_exp.sol

Link reference

https://x.com/audit_911/status/2063565495073415618

20260604 BYToken - Permissionless triggerAutoBurn Reserve Manipulation

Lost: ~$87,402 (146.60 WBNB)

forge test --contracts src/test/2026-06/BYToken_exp.sol -vvv

Contract

BYToken_exp.sol

Link reference

https://hacked.slowmist.io

20260604 ATM Token - Hidden transferFrom Auto-Swap Drain

Lost: ~$243,543 USDT

forge test --contracts src/test/2026-06/ATM_exp.sol -vvv

Contract

ATM_exp.sol

Link reference

https://hacked.slowmist.io

20260530 AROS - Signature Replay

Lost: ~$295K

forge test --contracts src/test/2026-05/AROS_exp.sol -vvv --evm-version prague

Contract

AROS_exp.sol

Link reference

https://bscscan.com/tx/0xe89fe640ec5241edfca7d8dcae77a0a4270dee15e4bbd043fc60e393aabf41e1 https://x.com/TenArmorAlert/status/2061289921990570349

20260529 YSDAO - Price Manipulation and Tax Bypass

Lost: ~19.49K USDT

forge test --contracts src/test/2026-05/YSDAO_exp.sol -vvv

Contract

YSDAO_exp.sol

Link reference

https://bscscan.com/tx/0x91f26d96373bbec6a6a8517c7be995a739d65f20fed589d53bc47d8140f91907

20260528 LegendaryMoneyMonNft - ecrecover address(0) Signature Bypass

Lost: ~$85.5K USD (85,519 USDT)

forge test --contracts src/test/2026-05/LegendaryMoneyMonNft_exp.sol -vvv

Contract

LegendaryMoneyMonNft_exp.sol

Link reference

https://x.com/SlowMist_Team/status/2060205558687486441

20260528 DxSale - Ownership Override Attack

Lost: ~7.3M USD

forge test --contracts src/test/2026-05/DxSale_exp.sol -vvv

Contract

DxSale_exp.sol

Link reference

https://crypto.news/dxsale-exploit-drains-7-3m-in-bnb-through-hidden-contract-backdoor/ https://x.com/Tahax1/status/1928169316736651568 https://x.com/CoinsultAudits/status/1928203831996297670

20260527 Joe Agent - Reentrancy in removeLiquidityViaContract

Lost: ~$45K USD (62.5 BNB + ~1.196M JOE)

forge test --contracts src/test/2026-05/JoeAgent_exp.sol -vvv

Contract

JoeAgent_exp.sol

Link reference

https://x.com/SlowMist_Team/status/2059887450663551352

20260526 SKP Token - Owner Backdoor LP Burn + Price Manipulation

Lost: ~$212K USD

forge test --contracts src/test/2026-05/SKP_exp.sol -vvv

Contract

SKP_exp.sol

Link reference

https://www.cryptotimes.io/2026/05/27/skp-liquidity-exploit-drains-212k-across-bnb-chain-defi-protocols/

20260526 SKP Token - Deliberately Engineered Drain (Insider Exploit / Rug Pull)

Lost ~$212,195 USDT

Classification: Premeditated insider exploit — NOT a conventional external hack.

forge test --contracts src/test/2026-05/SKP_exp2.sol -vvv

Contract

SKP_exp2.sol

Link reference

20260525 SquidRouterModule - Missing caller check

Lost: 0.25 WBTC + 0.29 wTAO + 0.02 WETH

FOUNDRY_EVM_VERSION=cancun forge test --contracts ./src/test/2026-05/SquidRouterModule_exp.sol -vvv

Contract

SquidRouterModule_exp.sol

Link reference

https://t.me/defimon_alerts/3045

20260525 New Market Trading - SquidRouterModule Missing Caller Check

Lost: ~$3.98M USD

FOUNDRY_EVM_VERSION=cancun forge test --contracts src/test/2026-05/NewMarketTrading_exp.sol --match-contract NewMarketTradingExploit -vv

Contract

NewMarketTrading_exp.sol

Link reference

https://rekt.news/newmarkettrading-rekt

20260525 WUSD.fi - _englove Sybil Incentive Abuse

Lost: ~$200K USD (GLOVE emissions + LP drain)

forge test --contracts src/test/2026-05/WUSD_exp.sol -vvv

Contract

WUSD_exp.sol

Link reference

https://x.com/exvulsec/status/2058803971947385330

20260522 FractalProtocol - Business Logic Flaw

Lost: ~$13.7K

forge test --contracts src/test/2026-05/FractalProtocol_exp.sol -vvv

Contract

FractalProtocol_exp.sol

Link reference

https://arbiscan.io/tx/0x20db78913a51c3b3aece860ea142c240f3f8fa3b5bbf533a3d1d48eed857e10f https://x.com/DefimonAlerts/status/2058619391776878967

20260521 MureDistribution - Signature Verification Bypass

Lost: ~5.45 ETH

forge test --contracts src/test/2026-05/MureDistribution_exp.sol -vvv

Contract

MureDistribution_exp.sol

Link reference

https://etherscan.io/tx/0xb83040361a0ec72fa2d06ad69493226518a5f8b5d96c19b400626248f9c5b798 https://x.com/DefimonAlerts/status/2058211424761942226

20260520 MAPProtocol - Arbitrary Mint

Lost: ~$180K

forge test --contracts src/test/2026-05/MAPProtocol_exp.sol -vvv

Contract

MAPProtocol_exp.sol

Link reference

https://etherscan.io/tx/0x31e56b4737649e0acdb0ebb4eca44d16aeca25f60c022cbde85f092bde27664a https://x.com/MapProtocol/status/2059587998409490510

20260519 ElevateFi - Reserve Price Manipulation

Lost: ~16,000 USD

forge test --contracts ./src/test/2026-05/ElevateFi_exp.sol -vvv --evm-version cancun

Contract

ElevateFi_exp.sol

Link reference

https://t.me/defimon_alerts/3040

20260518 TesseraSwap - Callback Repayment Price Spread

Lost: ~$20K

forge test --contracts ./src/test/2026-05/TesseraSwap_exp.sol -vvv --evm-version shanghai

Contract

TesseraSwap_exp.sol

Link reference

https://t.me/defimon_alerts/3038

20260517 VerusBridge - Insufficient Validation

Lost: ~$11.58M

forge test --contracts src/test/2026-05/VerusBridge_exp.sol -vvv

Contract

VerusBridge_exp.sol

Link reference

https://etherscan.io/tx/0x6990f01720f57fc515d0e976a0c4f8157e0a9529194c4c15d190e98d087eb321 https://x.com/VerusCoin/status/2057465214975492358

20260517 SEAToken - Business Logic Flaw

Lost: ~$110K

forge test --contracts src/test/2026-05/SEAToken_exp.sol -vvv

Contract

SEAToken_exp.sol

Link reference

https://arbiscan.io/tx/0x001cb16e17c4c5a5c4d02423c9e9b2f2b11ab6b2a1baf2ba53b8fcaf06167716 https://anomly.rs/metasea-redeemposition-distributor-drain-arb-2026-05-17

20260515 AdsharesBridge - Insufficient Validation

Lost: ~$628K

forge test --contracts src/test/2026-05/AdsharesBridge_exp.sol -vvv

Contract

AdsharesBridge_exp.sol

Link reference

20260512 SQTokenStaking - Access Control

Lost: ~$346.1K

forge test --contracts src/test/2026-05/SQTokenStaking_exp.sol -vvv --evm-version prague

Contract

SQTokenStaking_exp.sol

Link reference

https://bscscan.com/tx/0x1bae633eda9b3d98999ea116bc403712eaa07093ec32bd6d559085cc4607f5b8 https://x.com/Defi_Nerd_sec/status/2054425936746148148

20260511 INKFinance - Business Logic Flaw

Lost: ~$140K

forge test --contracts src/test/2026-05/INKFinance_exp.sol -vvv

Contract

INKFinance_exp.sol

Link reference

20260511 HumaFinance - Credit Approval Bypass

Lost: ~$101K (82,315 USDC + 19,074 USDC.e)

forge test --contracts src/test/2026-05/HumaCreditApprovalBypass_exp.sol -vv

Contract

HumaCreditApprovalBypass_exp.sol

Link reference

https://www.cryptotimes.io/2026/05/11/huma-finance-v1-exploit-on-polygon-drains-101k-in-usdc/

20260510 Renegade - Uninitialized Proxy

Lost: ~$209K

forge test --contracts src/test/2026-05/Renegade_exp.sol -vvv

Contract

Renegade_exp.sol

Link reference

https://arbiscan.io/tx/0x0e494685ace16d372066c5b4db959b58ebac6d88166c2d9d618e0e421dc0c77e https://x.com/renegade_fi/status/2053531772634427599 https://x.com/DefimonAlerts/status/2053538325969977801

20260507 TrustedVolumes - Signature Replay

Lost: ~$5.87M

forge test --contracts src/test/2026-05/TrustedVolumes_exp.sol --match-contract TrustedVolumesExploit -vv

Contract

TrustedVolumes_exp.sol

Link reference

https://rekt.news/trustedvolumes-rekt https://www.darknavy.org/web3/exploits/trustedvolumes-rfq-proxy-drain/ https://blog.verichains.io/p/trustedvolumes-exploit-analysis

20260505 Ekubo - Business Logic Flaw

Lost: ~$1.4M

forge test --contracts src/test/2026-05/Ekubo_exp.sol -vvv

Contract

Ekubo_exp.sol

Link reference

https://etherscan.io/tx/0x770bc9a1f7c32cb63a5002b9ceb5c7994cd3af0fc6b2309cb32d3c46f629daa0 https://x.com/EkuboProtocol/status/2051754481465856038 https://x.com/blockaid_/status/2051757787714118125

20260501 SharwaMarginTrading - Hegic collateral spot price manipulation

Lost: 32.85K USDC

forge test --contracts ./src/test/2026-05/SharwaMarginTrading_exp.sol -vvv

Contract

SharwaMarginTrading_exp.sol

Link reference

https://t.me/defimon_alerts/2975

20260428 RWAVault - Missing ERC4626 allowance check

Lost: 398,655.47 USDC

forge test --contracts ./src/test/2026-04/RWAVault_exp.sol -vvv

Contract

RWAVault_exp.sol

Link reference

https://t.me/defimon_alerts/2958

20260428 JUDAO - JUDAO sell-hook reserve drain

Lost: 205K USDT + 36 BNB

forge test --contracts ./src/test/2026-04/JUDAO_exp.sol -vvv --evm-version shanghai

Contract

JUDAO_exp.sol

Link reference

https://t.me/defimon_alerts/2955

20260427 Unverified_a152 - AllowanceTarget approval drain

Lost: 229K USDT

forge test --contracts ./src/test/2026-04/unverified_a152_exp.sol -vvv

Contract

unverified_a152_exp.sol

Link reference

https://t.me/defimon_alerts/2987

Lost: 413.13K USDC

forge test --contracts ./src/test/2026-04/SingularityDynaVault_exp.sol -vvv --evm-version shanghai

Contract

SingularityDynaVault_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2048698708309705069

20260423 GiddyVaultV3 - Incomplete Signature Coverage

Lost: $1.3M

forge test --contracts ./src/test/2026-04/giddyvaultv3_compound_auth_exp.sol -vvv --evm-version cancun

Contract

giddyvaultv3_compound_auth_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2047334517535642024

20260421 KipseliPropAMM - Pricing / Decimals Mismatch

Lost: 0.93 cbBTC

forge test --contracts ./src/test/2026-04/KipseliPropAMM_exp.sol -vvv --evm-version cancun

Contract

KipseliPropAMM_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2046873857571934254

20260420 JuiceboxREVLoans - Fake terminal loan source validation bypass

Lost: 21.77 ETH

forge test --contracts ./src/test/2026-04/JuiceboxREVLoans_exp.sol -vvv

Contract

JuiceboxREVLoans_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2046862935650345139

Lost: 0.15 WBTC

forge test --contracts ./src/test/2026-04/ThetanutsVaultShareRounding_exp.sol -vvv

Contract

ThetanutsVaultShareRounding_exp.sol

Link reference

https://t.me/defimon_alerts/2933

20260419 AaveRebalancerCreditDelegation - Arbitrary External Call / Credit Delegation Abuse

Lost: 6,999.91 WAVAX

forge test --contracts ./src/test/2026-04/AaveRebalancerCreditDelegation_exp.sol -vvv

Contract

AaveRebalancerCreditDelegation_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2046504796463808991

20260415 XLootStaking - Duplicate xLOOT Redemption

Lost: 6.21 ETH

forge test --contracts ./src/test/2026-04/XLootStaking_exp.sol -vvv

Contract

XLootStaking_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2044709964091187660

20260414 MONA LisaVault - reward-farming / BurnAddress accounting exploit!

Lost ~60.95K USDT

forge test --contracts src/test/2026-04/MONA_LisaVault_exp.sol -vvv

Contract

MONA_LisaVault_exp.sol

Link reference

https://x.com/exvulsec/status/2043928546662592949

20260414 Saturn Protocol - Vulnerability Disclosure

Lost: 0 (Disclosure only; no exploit occurred)

TVL at Risk: ~$35.7M

forge test --contracts src/test/2026-04/SaturnProtocol_exp.sol -vvv --fork-url https://rpc.ankr.com/eth

Contract

SaturnProtocol_exp.sol

Link reference

https://gist.github.com/sgInnora/b70ad98327649ed4ab976a122f45e485

Note: Vendor states SAT-001 (underflow) is mitigated by _validateTotals, and SAT-002 (tolerance compound) is a trusted-role design observation.

20260412 SubQuerySettings - Settings access control

Lost: 218.07M SQT

forge test --contracts ./src/test/2026-04/SubQuerySettings_exp.sol -vvv --evm-version shanghai

Contract

SubQuerySettings_exp.sol

Link reference

https://t.me/defimon_alerts/2909

20260407 SquidMulticallAllowanceDrain - Arbitrary Call / Wrong Approval

Lost: 1 ETH

forge test --contracts ./src/test/2026-04/SquidMulticallAllowanceDrain_exp.sol -vvv --evm-version shanghai

Contract

SquidMulticallAllowanceDrain_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2041530294369386806

20260405 PerpPair - Virtual AMM Manipulation

Lost: 165K USDC

forge test --contracts ./src/test/2026-04/PerpPair_exp.sol -vvv --evm-version prague

Contract

PerpPair_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2041070927908126897

20260331 WhalebitOracleManipulation - Algebra spot-price oracle manipulation

Lost: 824K USD

forge test --contracts ./src/test/2026-03/WhalebitOracleManipulation_exp.sol -vvv

Contract

WhalebitOracleManipulation_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2039372077686251787

20260328 VTSwapHook - Pricing Error in UniswapV4 Hook

Lost: 4,507,034.03 vATH + 2,007,935.14 ATH

forge test --contracts ./src/test/2026-03/VTSwapHook_exp.sol -vvv --evm-version cancun

Contract

VTSwapHook_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2038647146098954283

20260327 EST Token - Incorrect Token Burn Mechanism

Lost: 150.2 WBNB

forge test --contracts src/test/2026-03/EST_exp.sol -vvv --evm-version shanghai

Contract

EST_exp.sol

Link reference

https://bscscan.com/address/0xD4524Be41cd452576aB9FF7b68a0b89aF8498a91

20260324 XocolatlLiquidator - Access Control / Input Validation

Lost: 3.25 cbETH and 0.22 WETH

forge test --contracts ./src/test/2026-03/XocolatlLiquidator_exp.sol -vvv --evm-version shanghai

Contract

XocolatlLiquidator_exp.sol

Link reference

https://t.me/defimon_alerts/2834

20260324 Univ3CollateralToken - Logic Error

Lost: 57K USD

forge test --contracts ./src/test/2026-03/Univ3CollateralToken_exp.sol -vvv --evm-version shanghai

Contract

Univ3CollateralToken_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2036449500512891317

20260323 BCE - Deflationary Token Logic Error

Lost: ~800,000 USDT

forge test --contracts ./src/test/2026-03/bce_exp.sol -vvv --evm-version cancun

Contract

bce_exp.sol

Link reference

https://t.me/defimon_alerts/2814

20260319 ATMBlindBox - Weak Randomness / Predictable RNG

Lost: 99K USD

forge test --contracts ./src/test/2026-03/ATMBlindBox_exp.sol -vvv --evm-version shanghai

Contract

ATMBlindBox_exp.sol

Link reference

https://t.me/defimon_alerts/2808

20260319 Revamp - Reward Accounting Drain

Lost: 2.99 BNB

forge test --contracts ./src/test/2026-03/Revamp_exp.sol -vvv --evm-version cancun

Contract

Revamp_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2034532544239088053

20260316 unverified - CheckoutPool Old BOC Missing Access Control

Lost: 85,730 USDC

forge test --contracts ./src/test/2026-03/unverified_1304_exp.sol -vvv --evm-version cancun

Contract

unverified_1304_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2034532547191820390

20260315 Venus THE - BorrowBehalf + Donation Attack

Lost: 913,858.263360521396654198 CAKE + 1,972.530910582753621682 WBNB

forge test --contracts src/test/2026-03/Venus_THE_exp.sol --match-test testTraceDrivenPoC -vvv

Contract

Venus_THE_exp.sol

Link reference

https://bscscan.com/tx/0x4f477e941c12bbf32a58dc12db7bb0cb4d31d41ff25b2457e6af3c15d7f5663f

20260315 StakeOnMe - Owner-privileged JAKE burn reserve drain

Lost: 0.28 ETH

forge test --contracts ./src/test/2026-03/unverified_237d_exp.sol -vvv

Contract

unverified_237d_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2034532549905580417

20260310 AlkemiEarn - Business Logic

Lost: 43.45 ETH

forge test --contracts ./src/test/2026-03/AlkemiEarn_exp.sol -vvv

Contract

AlkemiEarn_exp.sol

Link reference

https://x.com/blockaid_/status/2031351881029546194

Lost: ~240,000 US$

forge test -vvv --contracts ./src/test/2026-03/Curve_LlamaLend_exp.sol

Contract

Curve_LlamaLend_exp.sol

Link reference

https://x.com/yieldsandmore/status/2028368378457362629

20260222 LAXO Token - Incorrect Burn Logic

Lost: ~137,000 US$

forge test src/test/2026-02/LAXO_Token_exp.sol -vvv

Contract

LAXO_Token_exp.sol

Link reference

https://x.com/CertiKAlert/status/2027317095420072317

20260216 XDKRecycle - XDK recycle reserve manipulation

Lost: 6.84 WBNB

forge test --contracts ./src/test/2026-02/XDKRecycle_exp.sol -vvv --evm-version shanghai

Contract

XDKRecycle_exp.sol

Link reference

https://x.com/DefimonAlerts/status/2024163654631882916

20260215 Moonwell - Faulty Oracle

Lost: 1.78M USD

forge test --contracts ./src/test/2026-02/Moonwell_exp.sol -vvv

Contract

Moonwell_exp.sol

Link reference

https://forum.moonwell.fi/t/mip-x43-cbeth-oracle-incident-summary/2068

https://forum.moonwell.fi/t/recovery-plan-cbeth-incident-and-moonwell-apollo-onboarding/2084

https://x.com/pashov/status/2023872510077616223

https://x.com/moo9000/status/2024040101982990534

20260120 SynapLogic - Business Logic Flaw

NOTICE: SynapLogic is totally a cheat contract, with backdoors, vulnerabilities and rug pulls.

Lost: 27.6 ETH & 3450 USDC

forge test -vvv --contracts ./src/test/2026-01/SynapLogic_exp.sol

Contract

SynapLogic_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2013432861366292520?s=20

https://x.com/hklst4r/status/2013440353844461979?s=20

https://x.com/CertiKAlert/status/2013440963851755610?s=20

https://x.com/nn0b0dyyy/status/2013445844394279260?s=20

20260120 Makina - Price Oracle Manipulation

Lost: 5.1M USD

forge test -vvv --contracts ./src/test/2026-01/makina_exp.sol --evm-version cancun
# MUST use evm >= cancun

Contract

makina_exp.sol

Link reference

https://x.com/nn0b0dyyy/status/2013472538832314630

https://x.com/TenArmorAlert/status/2013460083078836342

https://x.com/CertiKAlert/status/2013473512116363734

20260112 MTToken - Incorrect Fee Logic

Lost: 37K USD

forge test -vvv --contracts ./src/test/2026-01/MTToken_exp.sol

Contract

MTToken_exp.sol

Link reference

https://x.com/TenArmorAlert/status/2010630024274010460?s=20

https://x.com/nn0b0dyyy/status/2010638145155661942?s=20

20260110 FutureSwap - Unit Mismatch

Lost: 433K USD

forge test -vvv --contracts ./src/test/2026-01/futureswap_exp.sol

Contract

futureswap_exp.sol

Link reference

https://x.com/nn0b0dyyy/status/2009922304927731717?s=20

20260109 Truebit - OverFlow

Lost: 8540ETH

forge test --contracts ./src/test/2026-01/Truebit_exp.sol -vvv

Contract

Truebit_exp.sol

Link reference

https://www.certik.com/zh-CN/resources/blog/truebit-incident-analysis

20260101 PRXVT - Bussiness Logic Flaw

Lost: 32.8 ETH

forge test --contracts ./src/test/2026-01/PRXVT_exp.sol -vvv --block-gas-limit 60000000 # use gas limit control iterations

Contract

PRXVT_exp.sol

Link reference

https://x.com/CertiKAlert/status/2006685174587605315

View Gas Reports

Every poc in this repository can produce a gas report like this:

forge test --gas-report --contracts <contract> -vvv

For Example: Let us find out the gas used in the Audius poc

Execution

forge test --gas-report --contracts ./src/test/Audius.exp.sol -vvv

Demo

Bug Reproduce

Moved to DeFiVulnLabs

FlashLoan Testing

Moved to DeFiLabs

License

This project is licensed under the Apache License 2.0.

defi

ethereum

foundry

solidity

web3

Significant stargazers

(top 24 of 45)

Ben {chmark} Adams

2,035 followers · starred Sep 2023

Cong Ding

0 followers · starred May 2026

cui

178 followers · starred Oct 2024

Ori

84 followers · starred Jun 2026

Similar repos

SunWeb3Sec/DeFiVulnLabs

To learn common smart contract vulnerabilities using Foundry!

1,979

same org

pcaversaccio/reentrancy-attacks

A chronological and (hopefully) complete list of reentrancy attacks to date.

1,628

sayan011/Immunefi-bug-bounty-writeups-list

curation of all(most) immunefi bug bounty writeups I could find(till now)

1,219

OpenZeppelin/damn-vulnerable-defi

755

Web-n-Composite/crypto-hacks-list

Cryptocurrency hacks list

358

crytic/awesome-ethereum-security

A curated list of awesome Ethereum security references

1,482

OffcierCia/DeFi-Developer-Road-Map

DeFi Developer roadmap is a curated Developer handbook which includes a list of the best tools for…

10,858

bkrem/awesome-solidity

⟠ A curated list of awesome Solidity resources, libraries, tools and more

7,052

SunWeb3Sec/DeFiHackLabs

README

DeFi Hacks Reproduce - Foundry

Table of Contents

Getting Started

Web3 Cybersecurity Academy

OnChain transaction debugging

Donate us

List of Past DeFi Incidents

Transaction debugging tools

Ethereum Signature Database

Useful tools

Hacks Dashboard

List of DeFi Hacks & POCs

Contract

20261006 MakerDAOFlipKeeper - the dormant ETH-A flip-keeper proxy's drain selector has no ds-auth check, so anyone can call it to make the keeper vat.hope() a caller-supplied worker and then deal its four undealt 2020 ETH-A auctions and flux/exit the freed 200 WETH of collateral out

Contract

Contract

Contract

20261001 FlashLoopAdapter - a Safe module authenticates its caller by asking that caller whether the module is enabled (self-attestation) and then makes an unconstrained call to a caller-supplied router, letting a fake Safe drive the adapter into draining real Safes that enabled it

Lost: 114.096151 WETH (~$305k, exactly reproduced) on Ethereum; two Safes that enabled the module as a victim were emptied - Safe #1 lost 1306.48 weETH of Aave collateral once its 1335.26 WETH debt was repaid, Safe #2 lost 6.426 weETH, all swapped to WETH via ODOS for the attacker's net

Contract

20260930 SKYDAO - sell-path controller burns the pair's SKYDAO and syncs before the net sell is credited, latching a near-zero reserve that a direct pair.swap drains for the pair's entire USDT

Lost: 59,914.12 USDT net to the attacker (exactly reproduced) on BNB Chain; the SKYDAO/USDT PancakeSwap V2 pair lost its entire 183,482.88 USDT reserve, drained by a direct pair.swap against the reserve the sell-path burn+sync latched to ~0

Contract

20260930 PositionManager - deposit values the vault's existing USDT at the manipulable PancakeSwap V3 spot price, so crashing the spot before depositing mints inflated shares that withdraw redeems in the same transaction

Lost: 32,080.604282 USDT (exactly reproduced) on BNB Chain; one atomic tx crashed the USDT/BTCB spot with an 8,000,000 USDT swap, then ran 24 deposit(1,000,000 USDT)/withdraw cycles to drain the vault's own PancakeSwap V3 position, the pool losing 32,096.098596 USDT

Contract

20260930 MUS - deposit refunds a first-deposit bonus and also credits it as withdrawable allocation, so a single deposit-withdraw from a fresh address returns more ETH than deposited

Lost: ~0.400168 ETH per deposit-withdraw cycle (exactly reproduced) on Ethereum; the MUS pool's standing 5.335 ETH was drained to 0 across the attack block, reported campaign total ~$36.9k across many fresh addresses

Contract

20260929 LPBonus - reserve inconsistency between reward accrual and LP withdrawal lets a manipulated MSN reserve inflate an LP reward claim

Lost: 92,607 USDT ($92.6k) on BNB Chain; one LP position claimed 1,442,165.713011 FIST against an accrual that funded ~940,041.612768 FIST, extracted by flash-swapping the MSN reserve down at accrual and back up at withdrawal

Contract

20260926 DAOstack - permissionless newOrganization lets an attacker hijack an existing Reputation contract and drain the Avatar

Lost: 4.025 ETH (full Genesis Alpha treasury); attacker minted 20,000 REP against the victim's real Reputation contract (supply 9,738.6 to 29,738.6, ~67% majority after a 200 REP GenesisProtocol vote-cost burn) and used it to self-install as a full-permission scheme

Contract

20260923 PancakeV3SwapHelper - Signed Swap Delta Accounting Error

Lost: 1.6488688845 BNB ($1.3K)

Contract

Link reference

20260921 DoinGud - acceptOffer replay via missing offer cleanup on the amount=0 path

Lost: 35,380.154566 USDC net (two byte-identical acceptOffer calls each paid out 35,486.935717 USDC from escrow; funded via a UniV2 flash swap, repaid 35,593.716868 USDC)

Contract

20260921 GaslessReservoirEnabler - erc20WithTransfersAndExecute lets a whitelisted module run unvalidated transferFrom calldata

Lost: 8.72 WETH ($23.8K) across 466 victims with standing approvals to the Enabler; PoC reproduces 3 victims, 2.3546 WETH ($6.4K, ~27% of the WETH-leg loss)

Contract

20260921 InternetToken - permissionless swapV3 with caller-supplied pool lets a fake callback mint INT arbitrarily

Lost: 764,145,702 INT + 5.846988 WETH (attacker minted 925.41M INT total, dumped 161.27M into the real INT/WETH pool for the WETH, reproduced to the wei)

Contract

20260918 Likwid - missing pairDelta update in leverage=0 margin borrow freezes AMM quote

Lost: 74.31 BNB (reproduced to within 3 wei)

Contract

20260916 Startale - transient storage init flag outlives the constructor and lets anyone reinitialize an ERC7579 account and drain it

Lost: 427.551160 USDC drained in this batch tx (32.555561 USDC reproduced across 3 of 23 victim accounts; ~$2,876 USDC+USDT aggregate across 41 known batches)

Contract

20260916 Flamincome - permissionless Convex stakeFor inflates Strategy NAV and lets VaultYUSDT overpay on withdrawAll

Lost: ~$345.9K USDT net attacker profit (gross Strategy loss ~$595K in aUSDT+USDT)

Contract

20260916 PrimeFinance - permissionless stale signed oracle report overwrite drains lending pool

Lost: 425.5 WHYPE ($33.4K) drained from the lending pool reserve

Contract

20260916 Nimiq - GSN forwarder skips signature check, relying solely on attacker-chosen paymaster

Lost: ~$50,463.79 (USDC, USDT0, USDC.e drained from a swap-liquidity wallet's standing approvals)

Contract

20260915 RsETHSafeModule - nested self-referential multicall authorization bypass drains Gnosis Safe via DELEGATECALL

Lost: 2,900 aEthrsETH (~$7.8M gross; 2,882.37 rsETH / ~$7.73M net to the MEV frontrunner)

Contract

20260915 BonfireSwap - missing caller authorization lets anyone force-sell any approved holder's tokens

Lost: 66 BNB ($47-50K); 58.78 BNB reproduced from a 5-victim subset (~98.7% of tokens drained)

Contract

20260912 SpiralHookV2 - Uniswap V4 spot-price borrow plus tx.origin-keyed same-block guard bypass

Lost: ~10.70728 ETH (reproduced exact to the wei)

Contract

20260912 YamFinance - dormant-DAO quorum governance takeover drains legacy UMA farming contracts

Lost: ~$121K (48.085 WETH + 763.101 UMA)

Contract

20260911 ORB - leveraged pool buyout + refund-before-sell reentrancy drains burnLP-depleted reserve

Lost: 44.9-45 BNB ($32,610.72)

Contract