Skip to content

SunWeb3Sec/DeFiHackLabs

Repository files navigation

DeFi Hacks Reproduce - Foundry

Reproduce DeFi hack incidents using Foundry.

430 incidents included.

Let's make Web3 secure! Join Discord

Notion: 101 root cause analysis of past DeFi hacked incidents

Transaction debugging tools

Disclaimer: This content serves solely as a proof of concept showcasing past DeFi hacking incidents. It is strictly intended for educational purposes and should not be interpreted as encouraging or endorsing any form of illegal activities or actual hacking attempts. The provided information is for informational and learning purposes only, and any actions taken based on this content are solely the responsibility of the individual. The usage of this information should adhere to applicable laws, regulations, and ethical standards.

Getting Started

All articles are also published on Substack.

OnChain transaction debugging

Who Support Us? DeFiHackLabs Received Grant From

gcc PM

Donate us

If you appreciate our work, please consider donating. Even a small amount helps us continue developing and improving our projects, and promoting web3 security.

  • EVM Chains - 0xD7d6215b4EF4b9B5f40baea48F41047Eb67a11D5
  • Giveth

List of Past DeFi Incidents

20240611 Crb2

20240611 JokInTheBox

20240610 Bazaar

20240608 YYStoken

20240606 MineSTM

20240604 NCD

20240601 VeloCore

20240531 MixedSwapRouter

20240529 SCROLL

20240529 MetaDragon

20240528 EXcommunity

20240527 RedKeysCoin

20240526 NORMIE

20240522 Burner

20240516 TCH

20240514 Sonne Finance

20240514 PredyFinance

20240510 GFOX

20240510 TSURU

20240508 GPU

20240507 SATURN

20240506 OSN

20240430 Yield

20240430 PikeFinance

20240425 NGFS

20240424 XBridge

20240424 YIEDL

20240422 Z123

20240420 Rico

20240419 HedgeyFinance

20240416 SATX

20240416 MARS_DEFI

20240415 Chainge

20240412 FIL314

20240412 SumerMoney

20240412 GROKD

20240409 UPS

20240408 SQUID

20240404 WSM

20240401 ATM

20240401 OpenLeverage

20240329 PrismaFi

20240328 LavaLending

20240325 ZongZi

20240314 ARK

20240321 SSS

20240320 Paraswap

20240314 MO

20240313 IT

20240309 Juice

20240309 UnizenIO

20240307 GHT

20240306 ALP

20240306 TGBS

20240305 Woofi

20240228 Seneca

20240228 SMOOFSStaking

20240223 CompoundUni

20240223 BlueberryProtocol

20240221 DeezNutz404

20240221 GAIN

20240219 RuggedArt

20240216 ParticleTrade

20240215 DualPools

20240215 Miner

20240211 Game

20240210 FILX DN404

20240208 Pandora404

20240205 BurnsDefi

20240201 AffineDeFi

20240130 MIMSpell

20240128 BarleyFinance

20240127 CitadelFinance

20240125 NBLGAME

20240122 DAO_SoulMate

20240117 BmiZapper

20240117 SocketGateway

20240112 WiseLending

20240110 LQDX Alert

20240104 Gamma

20240102 MIC

20240102 RadiantCapital

20240101 OrbitChain

2023

20231230 ChannelsFinance

20231225 Telcoin

20231222 PineProtocol

20231220 TransitFinance

20231217 FloorProtocol

20231216 GoodDollar

20231216 NFTTrader

20231213 HYPR

20231206 TIME

20231206 ElephantStatus

20231205 BEARNDAO

20231202 bZxProtocol

20231201 UnverifiedContr_0x431abb

20231130 CAROLProtocol

20231129 AIS

20231125 TheNFTV2

20231122 KyberSwap

20231117 Token8633_9419

20231117 ShibaToken

20231115 LinkDAO

20231114 OKC Project

20231112 MEV_0x8c2d

20231112 MEV_0xa247

20231111 Mahalend

20231110 Raft_fi

20231110 GrokToken

20231107 MEVbot

20231106 TrustPad

20231106 TheStandard_io

20231102 3913Token

20231101 OnyxProtocol

20231031 UniBotRouter

20231028 AstridProtocol

20231024 MaestroRouter2

20231022 OpenLeverage

20231019 kTAF

20231018 HopeLend

20231018 MicDao

20231013 BelugaDex

20231013 WiseLending

20231012 Platypus

20231011 BH

20231008 pSeudoEth

20231007 StarsArena

20231005 DePayRouter

20230930 FireBirdPair

20230929 DEXRouter

20230926 XSDWETHpool

20230924 KubSplit

20230921 CEXISWAP

20230916 uniclyNFT

20230911 0x0DEX

20230909 BFCToken

20230908 APIG

20230907 HCT

20230905 JumpFarm

20230905 HeavensGate

20230905 FloorDAO

20230902 DAppSocial

20230829 EAC

20230827 Balancer

20230826 SVT

20230824 GSS

20230821 EHIVE

20230819 BTC20

20230818 ExactlyProtocol

20230814 ZunamiProtocol

20230809 EarningFram

20230802 CurveBurner

20230802 Uwerx

20230801 NeutraFinance

20230801 LeetSwap

20230731 GYMNET

20230730 Curve

20230726 Carson

20230724 Palmswap

20230723 MintoFinance

20230722 ConicFinance02

20230721 ConicFinance

20230721 SUT

20230720 Utopia

20230720 FFIST

20230718 APEDAO

20230718 BNO

20230717 NewFi

20230712 Platypus

20230712 WGPT

20230711 RodeoFinance

20230711 Libertify

20230710 ArcadiaFi

20230708 CIVNFT

20230708 Civfund

20230707 LUSD

20230704 BambooIA

20230704 BaoCommunity

20230703 AzukiDAO

20230630 Biswap

20230628 Themis

20230623 SHIDO

20230621 BabyDogeCoin02

20230621 BUNN

20230620 MIM

20230618 ARA

20230617 Pawnfi

20230615 CFC

20230615 DEPUSDT_LEVUSDC

20230612 Sturdy Finance

20230611 SellToken04

20230607 CompounderFinance

20230606 VINU

20230606 UN

20230602 NST SimpleSwap

20230601 DDCoin

20230601 Cellframenet

20230531 ERC20TokenBank

20230529 Jimbo

20230529 BabyDogeCoin

20230529 FAPEN

20230529 NOON_NO

20230525 GPT

20230524 LocalTrade

20230524 CS

20230523 LFI

20230514 landNFT

20230514 SellToken03

20230513 Bitpaidio

20230513 SellToken02

20230512 LW

20230511 SellToken01

20230510 SNK

20230509 MCC

20230509 HODL

20230506 Melo

20230505 DEI

20230503 NeverFall

20230502 Level

20230428 0vix

20230427 SiloFinance

20230424 Axioma

20230419 OLIFE

20230416 Swapos V2

20230415 HundredFinance

20230413 yearnFinance

20230412 MetaPoint

20230411 Paribus

20230409 SushiSwap

20230405 Sentiment

20230402 Allbridge

20230328 SafeMoon Hack

20230328 THENA

20230325 DBW

20230322 BIGFI

20230317 ParaSpace NFT

20230315 Poolz

20230313 EulerFinance

20230308 DKP

20230307 Phoenix

20230227 LaunchZone

20230227 SwapX

20230224 EFVault

20230222 DYNA

20230218 RevertFinance

20230217 Starlink

20230217 Dexible

20230217 Platypusdefi

20230210 Sheep Token

20230210 dForce

20230207 CowSwap

20230206 FDP Token

20230203 Orion Protocol

20230203 Spherax USDs

20230202 BonqDAO

20230130 BEVO

20230126 TomInu Token

20230119 SHOCO Token

20230119 ThoreumFinance

20230118 QTN Token

20230118 UPS Token

20230117 OmniEstate

20230116 MidasCapital

20230111 UFDao

20230111 ROE

20230110 BRA

20230103 GDS

2022

20221230 DFS

20221229 JAY

20221225 Rubic

20221223 Defrost

20221214 Nmbplatform

20221214 FPR

20221213 ElasticSwap

20221212 BGLD

20221211 Lodestar

20221210 MUMUG

20221210 TIFIToken

20221209 NOVAToken

20221207 AES

20221205 RFB

20221205 BBOX

20221202 OverNight

20221201 APC

20221129 MBC & ZZSH

20221129 SEAMAN

20221123 NUM

20221122 AUR

20221121 SDAO

20221119 AnnexFinance

20221117 UEarnPool

20221116 SheepFarm

20221110 DFXFinance

20221109 brahTOPG

20221108 MEV_0ad8

20221108 Kashi

20221107 MooCAKECTX

20221105 BDEX

20221027 VTF

20221027 Team Finance

20221026 N00d Token

20221025 ULME

20221024 Market

20221024 MulticallWithoutCheck

20221021 OlympusDAO

20221020 HEALTH Token

20221019 BEGO Token

20221018 HPAY

20221018 PLTD Token

20221017 Uerii Token

20221014 INUKO Token

20221014 EFLeverVault

20221014 MEVBOT a47b

20221012 ATK

20221011 Rabby Wallet SwapRouter

20221011 Templedao

20221010 Carrot

20221009 Xave Finance

20221006 RES-Token

20221002 Transit Swap

20221001 BabySwap

20221001 RL

20221001 Thunder Brawl

20220929 BXH

20220928 MEVBOT Badc0de

20220923 RADT-DAO

20220913 MevBot Private TX

20220910 DPC

20220909 YYDS

20220908 NewFreeDAO

20220908 Ragnarok Online Invasion

20220906 NXUSD

20220905 ZoomproFinance

20220902 ShadowFi

20220902 Bad Guys by RPF

20220828 DDC

20220824 LuckyTiger NFT

20220810 XSTABLE Protocol

20220809 ANCH

20220807 EGD Finance

20220802 Nomad Bridge

20220801 Reaper Farm

20220725 LPC

20220723 Audius

20220713 SpaceGodzilla

20220710 Omni NFT

20220706 FlippazOne NFT

20220701 Quixotic - Optimism NFT Marketplace

20220626 XCarnival

20220624 Harmony's Horizon Bridge

20220618 SNOOD

20220616 InverseFinance

20220608 GYMNetwork

20220608 Optimism - Wintermute

20220606 Discover

20220529 NOVO Protocol

20220524 HackDao

20220517 ApeCoin

20220508 Fortress Loans

20220430 Saddle Finance

20220430 Rari Capital/Fei Protocol

20220428 DEUS DAO

20220424 Wiener DOGE

20220423 Akutar NFT

20220421 Zeed Finance

20220416 BeanstalkFarms

20220415 Rikkei Finance

20220412 ElephantMoney

20220411 Creat Future

20220409 GYMNetwork

20220329 Ronin Network

20220329 Redacted Cartel

20220327 Revest Finance

20220326 Auctus

20220322 CompoundTUSDSweepTokenBypass

20220321 OneRing Finance

20220320 LI.FI

20220320 Umbrella Network

20220315 Agave Finance

20220315 Hundred Finance

20220313 Paraluni

20220309 Fantasm Finance

20220305 Bacon Protocol

20220303 TreasureDAO

20220214 BuildFinance - DAO

20220208 Sandbox LAND

20220205 Meter

20220204 TecraSpace

20220128 Qubit Finance

20220118 Multichain (Anyswap)

2021

20211221 Visor Finance

20211218 Grim Finance

20211214 Nerve Bridge

20211130 MonoX Finance

20211027 Cream Finance

20211015 Indexed Finance

20210916 SushiSwap Miso

20210915 Nimbus Platform

20210915 NowSwap Platform

20210912 ZABU Finance

20210903 DAO Maker

20210830 Cream Finance

20210817 XSURGE

20210811 Poly Network

20210804 WaultFinance

20210728 Levyathan Finance

20210710 Chainswap

20210702 Chainswap

20210628 SafeDollar

20210625 xWin Finance

20210622 Eleven Finance

20210607 88mph NFT

20210603 PancakeHunny

20210527 BurgerSwap

20210519 PancakeBunny

20210508 Rari Capital

20210508 Value Defi

20210502 Spartan

20210428 Uranium

20210308 DODO

20210305 Paid Network

20210204 Yearn YDai

20210125 Sushi Badger Digg

Before 2020

20201229 Cover Protocol

20201121 Pickle Finance

20201026 Harvest Finance

20200804 Opyn Protocol

20200628 Balancer Protocol

20200618 Bancor Protocol

20200419 LendfMe

20200418 UniSwapV1

20180422 Beauty Chain

20171106 Parity - 'Accidentally Killed It'


Transaction debugging tools

Phalcon | Tx tracer | Cruise | Ethtx | Tenderly | eigenphi

Ethereum Signature Database

4byte | sig db | etherface

Useful tools

ABI to interface | Get ABI for unverified contracts | ETH Calldata Decoder | ETHCMD - Guess ABI | Abi tools

Hacks Dashboard

Slowmist | Defillama | De.Fi | Rekt | Cryptosec


List of DeFi Hacks & POCs

20240616 Crb2 - business logic flaw

Lost: ~15K

forge test --contracts .\src\test\2024-06\Crb2_exp.sol  -vv --evm-version shanghai

Contract

Crb2_exp.sol

Link reference


20240611 JokInTheBox - business logic flaw

Lost: 9.2 eth

forge test --contracts .\src\test\2024-06\JokInTheBox.sol  -vv --evm-version cancun

Contract

JokInTheBox_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1800355604692910571


20240610 Bazaar - Insufficient Permission Check

Lost: 1.4M

forge test --contracts ./src/test/2024-06/Bazaar_exp.sol -vvv

Contract

Bazaar_exp.sol

Link reference

https://x.com/shoucccc/status/1800353122159833195


20240608 YYStoken - Business Logic Flaw

Lost: $28K

forge test --contracts  src/test/2024-06/YYS_exp.sol -vv

Contract

YYS_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1799610045589831833


20240606 MineSTM - Business Logic Flaw

Lost: $13.8K

forge test --contracts  src/test/2024-06/MineSTM_exp.sol -vv

Contract

MineSTM_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1798920774511898862


20240604 NCD - Business Logic Flaw

Lost: $6.4K

forge test --contracts  src/test/2024-06/NCD_exp.sol -vv

Contract

NCD_exp.sol

Link reference

https://x.com/SlowMist_Team/status/1797821034319765604


20240601 VeloCore - lack-of-access-control

Lost: $6.88M

forge test --contracts  src/test/2024-06/Velocore_exp.sol -vv

Contract

Velocore_exp.sol

Link reference

https://x.com/BeosinAlert/status/1797247874528645333


20240531 MixedSwapRouter - Arbitrary Call

Lost: >10700USD(WINR token)

forge test --contracts ./src/test/2024-05/MixedSwapRouter_exp.sol -vvv

Contract

MixedSwapRouter_exp.sol

Link reference

https://x.com/ChainAegis/status/1796484286738227579


20240529 SCROLL - Integer Underflow

Lost: 76 ETH

forge test --contracts ./src/test/2024-05/SCROLL_exp.sol -vvv

Contract

SCROLL_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1795650745448169741


20240529 MetaDragon - Lack of Access Control

Lost: ~ $180k

forge test --contracts src/test/2024-05/MetaDragon_exp.sol -vvvvv  --evm-version shanghai

Contract

MetaDragon_exp.sol

Link reference

https://x.com/Phalcon_xyz/status/1795746828064854497


20240528 EXcommunity - Business Logic Flaw

Lost: 33BNB

forge test --contracts ./src/test/2024-05/EXcommunity_exp.sol -vvv

Contract

EXcommunity_exp.sol

Link reference

https://x.com/SlowMist_Team/status/1795648617530995130


20240527 RedKeysCoin - Weak RNG

Lost: $12K

forge test --contracts ./src/test/2024-05/RedKeysCoin_exp.sol -vvv --evm-version shanghai

Contract

RedKeysCoin_exp.sol

Link reference


20240526 NORMIE - Business Logic Flaw

Lost: $490K

forge test --contracts ./src/test/2024-05/NORMIE_exp.sol -vv

Contract

NORMIE_exp.sol

Link reference

https://x.com/lookonchain/status/1794680612399542672


20240522 Burner - sandwich ack

Lost: 1.7 eth

forge test --contracts ./src/test/2024-05/Burner_exp.sol -vv

Contract

Burner_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1792925754243625311


20240516 TCH - Signature Malleability Vulnerability

Lost: $18K

forge test --contracts ./src/test/2024-05/TCH_exp.sol -vvv

Contract

TCH_exp.sol

Link reference

https://x.com/DecurityHQ/status/1791180322882629713


20240514 Sonne Finance - Precision loss

Lost: $20M

forge test --contracts ./src/test/2024-05/Sonne_exp.sol -vvv

Contract

Sonne_exp.sol

Link reference

https://neptunemutual.com/blog/taking-a-closer-look-at-sonne-finance-exploit/


20240514 PredyFinance - Reentrancy

Lost: $464K

forge test --contracts ./src/test/2024-05/PredyFinance_exp.sol -vvv

Contract

PredyFinance_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1790307019590680851


20240510 GFOX - lack of access control

Lost: 330K USD

forge test --contracts ./src/test/2024-05/GFOX_exp.sol -vvv --evm-version shanghai

Contract

GFOX_exp.sol

Link reference

https://twitter.com/CertiKAlert/status/1788751142144401886


20240510 TSURU - Insufficient Validation

Lost: 140K

forge test --contracts ./src/test/2024-05/TSURU_exp.sol -vvv --evm-version shanghai

Contract

TSURU_exp.sol

Link reference

https://base.tsuru.wtf/usdtsuru-exploit-incident-report


20240508 GPU - self transfer

Lost: ~32K USD

forge test --contracts src/test/2024-05/GPU_exp.sol -vvv

Contract

GPU_exp.sol

Link reference

https://twitter.com/PeckShieldAlert/status/1788153869987611113


20240507 SATURN - Price Manipulation

Lost: ~15 BNB

forge test --contracts src/test/2024-05/OSN_exp.sol -vvv

Contract

SATURN_exp.sol

Link reference

https://twitter.com/ChainAegis/status/1787667253435195841


20240506 OSN - Reward Distribution Problem

Lost: ~109K USD

forge test --contracts src/test/2024-05/OSN_exp.sol -vvv --evm-version shanghai

Contract

OSN_exp.sol

Link reference

https://twitter.com/SlowMist_Team/status/1787330586857861564


20240430 Yield - Business Logic Flaw

Lost: 181K

forge test --contracts ./src/test/2024-04/Yield_exp.sol -vvv

Contract

Yield_exp.sol

Link reference

https://twitter.com/peckshield/status/1785121607192817692

https://medium.com/immunefi/yield-protocol-logic-error-bugfix-review-7b86741e6f50


20240430 PikeFinance - Uninitialized Proxy

Lost: 1.4M

forge test --contracts ./src/test/2024-04/PikeFinance_exp.sol -vvv

Contract

PikeFinance_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1785508900093194591


20240425 NGFS - Bad Access Control

Lost: ~190K

forge test --contracts ./src/test/2024-04/NGFS_exp.sol -vvv --evm-version shanghai

Contract

NGFS_exp.sol

Link reference

https://twitter.com/CertiKAlert/status/1783476515331616847


20240424 XBridge - Logic Flaw

Lost: >200k USD(plus a lot of STC, SRLTY, Mazi tokens)

forge test --contracts ./src/test/2024-04/XBridge_exp.sol -vvv

Contract

XBridge_exp.sol


20240424 YIEDL - Input Validation

Lost: 150k USD

forge test --contracts ./src/test/2024-04/YIEDL_exp.sol -vvv

Contract

YIEDL_exp.sol

20240422 Z123 - price manipulation

Lost: 136k USD

forge test --contracts ./src/test/2024-04/Z123_exp.sol -vvv

Contract

Z123_exp.sol

Link reference

https://twitter.com/PeckShieldAlert/status/1782322484911784385


20240420 Rico - Arbitrary Call

Lost: 36K

forge test --contracts ./src/test/2024-04/Rico_exp.sol -vvv

Contract

Rico_exp.sol

Link reference

https://twitter.com/ricocreditsys/status/1781803698940781009


20240419 HedgeyFinance - Logic Flaw

Lost: 48M USD

forge test --contracts ./src/test/2024-04/HedgeyFinance_exp.sol -vvv

Contract

HedgeyFinance_exp.sol

Link reference

https://twitter.com/Cube3AI/status/1781294512716820918


20240416 SATX - Logic Flaw

Lost: ~ 50 BNB

forge test --contracts src/test/2024-04/SATX_exp.sol -vvv

Contract

SATX_exp.sol

Link reference

https://x.com/bbbb/status/1780341239801393479


20240416 MARS - Bad Reflection

Lost: >100K

forge test --contracts src/test/2024-04/MARS_exp.sol -vv

Contract

MARS_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1780150315603701933

20240415 Chainge - Input Validation

Lost: ~200K

forge test --contracts ./src/test/2024-04/Chainge_exp.sol -vvv

Contract

Chainge_exp.sol

Link reference

https://twitter.com/CyversAlerts/status/1779875922381860920


20240412 FIL314 - Insufficient Validation And Price Manipulation

Lost: ~14 BNB

forge test --contracts ./src/test/2024-04/FIL314_exp.sol -vvv

Contract

FIL314_exp.sol

Link reference


20240412 SumerMoney - Reentrancy

Lost: 350K

forge test --contracts ./src/test/2024-04/SumerMoney_exp.sol -vvv

Contract

SumerMoney_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1778986926705672698


20240412 GROKD - lack of access control

Lost: $~150 BNB

forge test --contracts ./src/test/2024-04/GROKD_exp.sol -vvv

Contract

GROKD_exp.sol

Link reference

https://x.com/hipalex921/status/1778482890705416323?t=KvvG83s7SXr9I55aftOc6w&s=05


20240409 UPS - business logic flaw

Lost: $~28K USD

forge test --contracts ./src/test/2024-04/UPS_exp.sol -vvv

Contract