Incidents
Other people's exploits, read so yours don't happen.
Each breakdown starts from the primary source: the post-mortem, the attack transactions, the fix. Then the one question that matters for your code: what check would have stopped it.
Incidents
Each breakdown starts from the primary source: the post-mortem, the attack transactions, the fix. Then the one question that matters for your code: what check would have stopped it.
$542.98K lost · Ethereum
One privileged function of a 2020 liquidation keeper lacked its auth check. An attacker settled four forgotten auctions and took 200 ETH.
$1.92M lost · Ethereum
A Barretenberg verifier bug let an attacker prove burns that never happened and withdraw 1.92M USDC, 73 days after the fix was released.
$1.73M lost · Ethereum
Two mintfCashPair calls left a debt of exactly -2^128, an unchecked uint128 cast made it zero, and a contract deprecated in 2022 paid out $1.73M.
$120.40M lost · Cronos
Direct TONIC transfers to the lending market increased the tTONIC exchange rate without minting new tokens, inflating collateral value by $120.4M.
$8.70M lost · Base
Direct token donations inflated the receipt-token exchange rate while a thin-liquidity oracle let the same actor pump the collateral price.
$9.05M lost · Hedera
An all-zero signature passed the oracle verifier, SAUCE was priced 10^12 times too high, and the lending pool was drained against 250 tokens.
$1.75M lost · Ethereum
An enclave key in a public repo and an attestation check that allowed debug mode let forged proofs withdraw $1.75M from the bridge.
$116.00M lost · Solana
Mango Markets lost $116 million because its lending module trusted a low-liquidity spot price that could be moved within a single transaction.
Give Atlant a task
Could the same thing happen in your code?
Get it checked →