QTN — reflection-token manipulation (skim)
2023-01 · Ethereum
THE INCIDENT
QTN charges a buy-time limit and taxes transfers to the LP pair, crediting the pair's balance without updating reserves. After buying QTN, the attacker transfers QTN to the pair 40 times and skims the o 40 helper contracts, waits out the _timeLimitFromLastBuy, then pulls the tokens back and swaps for WETH.
THE LESSON
Same family as BEVO/BRA: tokens that credit LP-pair balances via tax/reflection without sync() are skimmable; check custom _transfer logic for pair-address branches.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#TokenMechanics #DeFi #SmartContract #Security
2023-01 · Ethereum
THE INCIDENT
QTN charges a buy-time limit and taxes transfers to the LP pair, crediting the pair's balance without updating reserves. After buying QTN, the attacker transfers QTN to the pair 40 times and skims the o 40 helper contracts, waits out the _timeLimitFromLastBuy, then pulls the tokens back and swaps for WETH.
THE LESSON
Same family as BEVO/BRA: tokens that credit LP-pair balances via tax/reflection without sync() are skimmable; check custom _transfer logic for pair-address branches.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#TokenMechanics #DeFi #SmartContract #Security
0
0
0
9
OmniEstate — business-logic flaw (staking reward calculation)
2023-01 · BNB
THE INCIDENT
The staking pool's invest() accepted arbitrary parameters — the attacker invests with qty_ort=1 and end_date=0, then immediately calls withdrawAndClaim() on the created lock. The reward/lock zed end date granted a huge ORT payout relative to the 1-token stake, which the attacker swaps back to WBNB.
THE LESSON
Audit reward and lock-time math for uninitialized or zero parameters (end_date=0, stake=1) that can grant outsized rewards.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
2023-01 · BNB
THE INCIDENT
The staking pool's invest() accepted arbitrary parameters — the attacker invests with qty_ort=1 and end_date=0, then immediately calls withdrawAndClaim() on the created lock. The reward/lock zed end date granted a huge ORT payout relative to the 1-token stake, which the attacker swaps back to WBNB.
THE LESSON
Audit reward and lock-time math for uninitialized or zero parameters (end_date=0, stake=1) that can grant outsized rewards.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
0
0
0
4
Midas Capital — oracle manipulation via read-only reentrancy
2023-01 · Polygon
THE INCIDENT
Attacker deposits stMATIC as collateral and mints the WMATIC-STMATIC cToken, then triggers Curve's remove_liquidity on the MATIC/stMATIC pool, which re-enters via the ETH receive() (used by the oracle for the cToken price) is mid-update. During the callback the collateral price is inflated, so the attacker borrows all four Jarvis fx tokens (FJCHF/FJEUR/FJGBP/FAGEUR), then liquidates their own position and redeems the stMATIC.
THE LESSON
Pricing collateral from a live pool that can be distorted mid-call via a token/ETH callback is a read-only-reentrancy oracle attack — verify oracle sources are reentrancy-safe or use TWAP.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#Reentrancy #SmartContract #DeFi #Security
2023-01 · Polygon
THE INCIDENT
Attacker deposits stMATIC as collateral and mints the WMATIC-STMATIC cToken, then triggers Curve's remove_liquidity on the MATIC/stMATIC pool, which re-enters via the ETH receive() (used by the oracle for the cToken price) is mid-update. During the callback the collateral price is inflated, so the attacker borrows all four Jarvis fx tokens (FJCHF/FJEUR/FJGBP/FAGEUR), then liquidates their own position and redeems the stMATIC.
THE LESSON
Pricing collateral from a live pool that can be distorted mid-call via a token/ETH callback is a read-only-reentrancy oracle attack — verify oracle sources are reentrancy-safe or use TWAP.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#Reentrancy #SmartContract #DeFi #Security
1
0
1
12
GDS — business-logic flaw (reward claim farming)
2023-01 · BNB
THE INCIDENT
GDS's ClaimReward flow let a deposit of LP tokens trigger claim logic keyed per contract with no lock or eligibility check. The attacker adds liquidity with flash-loaned USDT, splits LP+GDS across 100 contracts, and each helper's transferToken()/withdraw() burns a dust GDS amount and forwards the LP balance (plus swap proceeds) back to the attacker, then removes liquidity and repays.
THE LESSON
Reward/vault logic that credits on deposit and can be split across unlimited fresh accounts with no time-weighting or lock is farmable — check that rewards are accrued per-user over time, not per-contract on demand.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
2023-01 · BNB
THE INCIDENT
GDS's ClaimReward flow let a deposit of LP tokens trigger claim logic keyed per contract with no lock or eligibility check. The attacker adds liquidity with flash-loaned USDT, splits LP+GDS across 100 contracts, and each helper's transferToken()/withdraw() burns a dust GDS amount and forwards the LP balance (plus swap proceeds) back to the attacker, then removes liquidity and repays.
THE LESSON
Reward/vault logic that credits on deposit and can be split across unlimited fresh accounts with no time-weighting or lock is farmable — check that rewards are accrued per-user over time, not per-contract on demand.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
0
0
1
15
BRA — business-logic flaw (fee/tax accounting without sync)
2023-01 · BNB
THE INCIDENT
BRA's _transfer() charges a double tax when sender or recipient is the LP pair but never calls sync(), so the pair's reserves stay larger than its actual balance. The attacker flash-loans rs it all to the pair, and repeatedly calls skim() (101x) to harvest the tax-inflated excess, then sells BRA back to USDT/WBNB.
THE LESSON
Any custom token fee/tax logic that mutates balances on LP-pair interactions without a following sync() leaves the excess skimmable — check tax tokens for missing sync().
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
2023-01 · BNB
THE INCIDENT
BRA's _transfer() charges a double tax when sender or recipient is the LP pair but never calls sync(), so the pair's reserves stay larger than its actual balance. The attacker flash-loans rs it all to the pair, and repeatedly calls skim() (101x) to harvest the tax-inflated excess, then sells BRA back to USDT/WBNB.
THE LESSON
Any custom token fee/tax logic that mutates balances on LP-pair interactions without a following sync() leaves the excess skimmable — check tax tokens for missing sync().
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
0
0
0
9
BEVO — reflection-token manipulation (flashloan-assisted)
2023-01 · BNB
THE INCIDENT
BEVO is a reflective token whose deliver() burns the caller's reflected balance, inflating every other holder's token balance including the LP pair's. Attacker flash-borrows WBNB, swaps it for wice and skim() on the BEVO-WBNB pair, then swaps the pair's excess BEVO for WBNB and repays the loan (144 BNB profit). The pair's reserves never matched its real balance, so the k-invariant check was satisfied by stale accounting.
THE LESSON
Reflective/rebasing tokens whose deliver()/skim() can desync an LP pair's real balance from its reserves are an instant drain pattern — hunt for deliver()+skim() pairs.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
2023-01 · BNB
THE INCIDENT
BEVO is a reflective token whose deliver() burns the caller's reflected balance, inflating every other holder's token balance including the LP pair's. Attacker flash-borrows WBNB, swaps it for wice and skim() on the BEVO-WBNB pair, then swaps the pair's excess BEVO for WBNB and repays the loan (144 BNB profit). The pair's reserves never matched its real balance, so the k-invariant check was satisfied by stale accounting.
THE LESSON
Reflective/rebasing tokens whose deliver()/skim() can desync an LP pair's real balance from its reserves are an instant drain pattern — hunt for deliver()+skim() pairs.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
0
0
1
16
TIFI Finance — oracle manipulation (borrow priced off WBNB / BUSD pair)
2022-12 · BSC
THE INCIDENT
Flash-swap 5 WBNB + 500 BUSD, deposit BUSD to TIFI, swap WBNB→BUSD on the protocol router to skew the WBNB/BUSD pair, then `borrow(TIFIToken)` — priced off that pair's ut excess TIFI which is dumped for WBNB before repayment.
THE LESSON
Lending borrow limits read from live pair reserves are manipulable within one flash swap.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#OracleManipulation #DeFi #SmartContract #Security
2022-12 · BSC
THE INCIDENT
Flash-swap 5 WBNB + 500 BUSD, deposit BUSD to TIFI, swap WBNB→BUSD on the protocol router to skew the WBNB/BUSD pair, then `borrow(TIFIToken)` — priced off that pair's ut excess TIFI which is dumped for WBNB before repayment.
THE LESSON
Lending borrow limits read from live pair reserves are manipulable within one flash swap.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#OracleManipulation #DeFi #SmartContract #Security
0
0
0
6
Rubic — access-control (router param in routerCallNative)
2022-12 · Ethereum
THE INCIDENT
`routerCallNative` called the `router` field (attacker-set to the USDC token) with attacker data, executing `transferFrom(victim → attacker)` for 26 victims who had approved the Rubic USDC.
THE LESSON
Cross-chain router params must be validated against a whitelist — attacker-chosen routers turn approved allowances into drains.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
2022-12 · Ethereum
THE INCIDENT
`routerCallNative` called the `router` field (attacker-set to the USDC token) with attacker data, executing `transferFrom(victim → attacker)` for 26 victims who had approved the Rubic USDC.
THE LESSON
Cross-chain router params must be validated against a whitelist — attacker-chosen routers turn approved allowances into drains.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
1
0
2
14
RFB — tokenomics (buy / sell tax asymmetry)
2022-12 · BSC
THE INCIDENT
Flashloan 20 BNB; the attacker loops 50 BNB→RFB→BNB round trips with decreasing amounts, exploiting RFB's asymmetric buy/sell fees to profit on each round, then repays the loan.
THE LESSON
Tax-asymmetric rbitrage machines — model buy+sell fees together when auditing tokenomics.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
2022-12 · BSC
THE INCIDENT
Flashloan 20 BNB; the attacker loops 50 BNB→RFB→BNB round trips with decreasing amounts, exploiting RFB's asymmetric buy/sell fees to profit on each round, then repays the loan.
THE LESSON
Tax-asymmetric rbitrage machines — model buy+sell fees together when auditing tokenomics.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
0
0
0
10
Overnight — stable-pool imbalance arbitrage
2022-12 · Avalanche
THE INCIDENT
Flashloans of USDC.e/USDC are used to mint qiUSDCn collateral and borrow USDC.e from Benqi, then the attacker repeatedly calls `addLiquidity` with only USDC.e and `removeLiquidityImbalance` on the nUSD SD+ cheaply through the imbalanced pool, and redeems USD+ 1:1 for USDC — six rounds of profit.
THE LESSON
Multi-token stable pools allowing imbalanced add/remove let attackers arbitrage the mint price against 1:1 redemption.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
2022-12 · Avalanche
THE INCIDENT
Flashloans of USDC.e/USDC are used to mint qiUSDCn collateral and borrow USDC.e from Benqi, then the attacker repeatedly calls `addLiquidity` with only USDC.e and `removeLiquidityImbalance` on the nUSD SD+ cheaply through the imbalanced pool, and redeems USD+ 1:1 for USDC — six rounds of profit.
THE LESSON
Multi-token stable pools allowing imbalanced add/remove let attackers arbitrage the mint price against 1:1 redemption.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
0
0
0
22
Nova Exchange — access-control (public rewardHolders with amount param)
2022-12 · BSC
THE INCIDENT
`rewardHolders(amount)` was public and accepted a caller-chosen amount, minting/distributing NOVA to holders; the attacker called it with 1e28 and received a corresponding NOVA ward functions that accept caller-supplied amounts are free mints — amounts must come from internal accounting.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
2022-12 · BSC
THE INCIDENT
`rewardHolders(amount)` was public and accepted a caller-chosen amount, minting/distributing NOVA to holders; the attacker called it with 1e28 and received a corresponding NOVA ward functions that accept caller-supplied amounts are free mints — amounts must come from internal accounting.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
0
0
0
4
Nimbus Platform — reward-price manipulation + staking
2022-12 · BSC
THE INCIDENT
Flashloan WBNB plus a flash-swap of the NBU_WBNB/NIMB pair; swapping NBU_WBNB→NIMB pumps the NIMB reward-token price used by three staking contracts, the attacker calls `getReward()` on three ontracts and dumps NIMB/GNIMB for WBNB.
THE LESSON
Staking reward payouts valued via a live pair price are manipulable — fix or TWAP the reward valuation.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#OracleManipulation #DeFi #SmartContract #Security
2022-12 · BSC
THE INCIDENT
Flashloan WBNB plus a flash-swap of the NBU_WBNB/NIMB pair; swapping NBU_WBNB→NIMB pumps the NIMB reward-token price used by three staking contracts, the attacker calls `getReward()` on three ontracts and dumps NIMB/GNIMB for WBNB.
THE LESSON
Staking reward payouts valued via a live pair price are manipulable — fix or TWAP the reward valuation.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#OracleManipulation #DeFi #SmartContract #Security
1
0
1
29
MUMUG — bond pricing off pair reserves + flashswap
2022-12 · Avalanche
THE INCIDENT
Flash-swap the MU/MUG pair's MU, sell MU→USDC.e to pump the USDC price in MU terms, then call `mu_bond`/`mu_gold_bond` which price bonds off the manipulated pair, swap back and repay.
THE iced off spot pair reserves is flash-loanable — use TWAPs or fixed prices.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
2022-12 · Avalanche
THE INCIDENT
Flash-swap the MU/MUG pair's MU, sell MU→USDC.e to pump the USDC price in MU terms, then call `mu_bond`/`mu_gold_bond` which price bonds off the manipulated pair, swap back and repay.
THE iced off spot pair reserves is flash-loanable — use TWAPs or fixed prices.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
0
0
0
4
MEV Bot 0x28d9 — access-control (flashloan recipient drain)
2022-12 · Ethereum
THE INCIDENT
The attacker loops DODO `flashLoan` calls with the bot as `assetTo`, so the bot repeatedly receives flashloaned USDT and its flawed callback returns its own USDT to the pool — each round e until it's empty (~$1300).
THE LESSON
Contracts receiving flashloans must validate the initiator — attacker-invoked flashloans drain bot balances.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
2022-12 · Ethereum
THE INCIDENT
The attacker loops DODO `flashLoan` calls with the bot as `assetTo`, so the bot repeatedly receives flashloaned USDT and its flawed callback returns its own USDT to the pool — each round e until it's empty (~$1300).
THE LESSON
Contracts receiving flashloans must validate the initiator — attacker-invoked flashloans drain bot balances.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
0
0
1
15
Lodestar — oracle manipulation (donate plvGLP) + compounding borrow
2022-12 · Arbitrum
THE INCIDENT
With flashloans from Aave/Radiant/UniswapV3, the attacker mints GLP via GMX, `donate()`s sGLP to the plvGLP depositor to pump the plvGLP exchange rate, then loops 16× nt(lplvGLP)` to compound against the inflated collateral price, finally borrowing out every Lodestar market (~4500 ETH).
THE LESSON
Exchange rates updated by donations + uncapped borrow-mint loops = collateral amplification — cap borrows and use TWAP pricing.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#OracleManipulation #DeFi #SmartContract #Security
2022-12 · Arbitrum
THE INCIDENT
With flashloans from Aave/Radiant/UniswapV3, the attacker mints GLP via GMX, `donate()`s sGLP to the plvGLP depositor to pump the plvGLP exchange rate, then loops 16× nt(lplvGLP)` to compound against the inflated collateral price, finally borrowing out every Lodestar market (~4500 ETH).
THE LESSON
Exchange rates updated by donations + uncapped borrow-mint loops = collateral amplification — cap borrows and use TWAP pricing.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#OracleManipulation #DeFi #SmartContract #Security
0
0
0
17
JayPeggers — reentrancy (buyJay token callback)
2022-12 · Ethereum
THE INCIDENT
`buyJay` accepts an attacker-supplied NFT address and calls `transferFrom` on it during purchase; the attacker's `transferFrom` re-enters `JAY.sell()` while the buy accounting is incomplete, es at an inflated balance, and they keep the ETH difference (~15.32 ETH).
THE LESSON
Bonding curves calling arbitrary token contracts are reentrant via transfer hooks — guard or use reentrancy-safe token handling.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#Reentrancy #SmartContract #DeFi #Security
2022-12 · Ethereum
THE INCIDENT
`buyJay` accepts an attacker-supplied NFT address and calls `transferFrom` on it during purchase; the attacker's `transferFrom` re-enters `JAY.sell()` while the buy accounting is incomplete, es at an inflated balance, and they keep the ETH difference (~15.32 ETH).
THE LESSON
Bonding curves calling arbitrary token contracts are reentrant via transfer hooks — guard or use reentrancy-safe token handling.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#Reentrancy #SmartContract #DeFi #Security
0
0
0
9
FPR — access-control (public setAdmin)
2022-12 · BSC
THE INCIDENT
`setAdmin(address)` on the four reward contracts was public; the attacker sets themselves as admin, calls `remaining()` to sweep each contract's FPR (and the LP pair's tokens via the fourth), and sells/removes `setAdmin` without auth is a giveaway — verify ownership on every privileged setter.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
2022-12 · BSC
THE INCIDENT
`setAdmin(address)` on the four reward contracts was public; the attacker sets themselves as admin, calls `remaining()` to sweep each contract's FPR (and the LP pair's tokens via the fourth), and sells/removes `setAdmin` without auth is a giveaway — verify ownership on every privileged setter.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#AccessControl #SmartContract #DeFi #Security
0
0
0
7
DFS — fee-on-transfer + skim loop
2022-12 · BSC
THE INCIDENT
Flash-swap the pair's USDT, then flash-swap half the DFS reserve; donate DFS back (98% then 95%) and loop 12 `skim(pair)` calls plus a final `skim(attacker)`, each triggering DFS's fee-on-transfer on the pair, then ewed price and repay with 0.5% fee.
THE LESSON
Fee-on-transfer + skim loops skew reserves in the attacker's favor — audit fee logic for per-transfer burns.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
2022-12 · BSC
THE INCIDENT
Flash-swap the pair's USDT, then flash-swap half the DFS reserve; donate DFS back (98% then 95%) and loop 12 `skim(pair)` calls plus a final `skim(attacker)`, each triggering DFS's fee-on-transfer on the pair, then ewed price and repay with 0.5% fee.
THE LESSON
Fee-on-transfer + skim loops skew reserves in the attacker's favor — audit fee logic for per-transfer burns.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
0
0
0
31
BGLD — migration pricing + skim manipulation
2022-12 · BSC
THE INCIDENT
Flashloan WBNB; the attacker donates to and skims the oldBGLD pair to pump its price, calls `Proxy.migrate()` converting oldBGLD→newBGLD at the manipulated rate, flashloans DEBT to repeat the skim trick on and finally sells newBGLD/DEBT into USDT.
THE LESSON
Token migration functions must not use manipulable spot prices — snapshots or TWAPs only.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
2022-12 · BSC
THE INCIDENT
Flashloan WBNB; the attacker donates to and skims the oldBGLD pair to pump its price, calls `Proxy.migrate()` converting oldBGLD→newBGLD at the manipulated rate, flashloans DEBT to repeat the skim trick on and finally sells newBGLD/DEBT into USDT.
THE LESSON
Token migration functions must not use manipulable spot prices — snapshots or TWAPs only.
Full analysis: s0sta.com/DeFi-Hacks-Rep…
#FlashLoan #DeFi #SmartContract #Security
0
0
0
24