DeFi Hacks Reproduce - Foundry

Reproduce DeFi hack incidents using Foundry.

427 incidents included.

Let's make Web3 secure! Join Discord

Notion: 101 root cause analysis of past DeFi hacked incidents

Disclaimer: This content serves solely as a proof of concept showcasing past DeFi hacking incidents. It is strictly intended for educational purposes and should not be interpreted as encouraging or endorsing any form of illegal activities or actual hacking attempts. The provided information is for informational and learning purposes only, and any actions taken based on this content are solely the responsibility of the individual. The usage of this information should adhere to applicable laws, regulations, and ethical standards.

Getting Started

Follow the instructions to install Foundry.
Clone and install dependencies:git submodule update --init --recursive
Contributing Guidelines

Web3 Cybersecurity Academy

All articles are also published on Substack.

OnChain transaction debugging

Lesson 1: Tools ( English | 中文 | Vietnamese | Korean | Spanish )
Lesson 2: Warm up ( English | 中文 | Korean )
Lesson 3: Write Your Own PoC (Price Oracle Manipulation) ( English | 中文 | Korean )
Lesson 4: Write Your Own PoC (MEV Bot) ( English | 中文 | Korean )
Lesson 5: Rugpull Analysis ( English | 中文 )
Lesson 6: Write Your Own PoC (Reentrancy) ( English | 中文 )
Lesson 7: Hack Analysis: Nomad Bridge, August 2022 ( English | 中文 )

Who Support Us? DeFiHackLabs Received Grant From

Donate us

If you appreciate our work, please consider donating. Even a small amount helps us continue developing and improving our projects, and promoting web3 security.

EVM Chains - 0xD7d6215b4EF4b9B5f40baea48F41047Eb67a11D5
Giveth

List of Past DeFi Incidents

20240514 Sonne Finance

20240514 PredyFinance

20240419 HedgeyFinance

20240401 OpenLeverage

20240228 SMOOFSStaking

20240223 CompoundUni

20240223 BlueberryProtocol

20240221 DeezNutz404

20240221 GAIN

20240219 RuggedArt

20240216 ParticleTrade

20240128 BarleyFinance

20240127 CitadelFinance

20240125 NBLGAME

20240122 DAO_SoulMate

20240117 BmiZapper

20240117 SocketGateway

20240102 RadiantCapital

20240101 OrbitChain

2023

20231230 ChannelsFinance

20231225 Telcoin

20231222 PineProtocol

20231220 TransitFinance

20231217 FloorProtocol

20231206 ElephantStatus

20231205 BEARNDAO

20231202 bZxProtocol

20231201 UnverifiedContr_0x431abb

20231130 CAROLProtocol

20231129 AIS

20231125 TheNFTV2

20231122 KyberSwap

20231117 Token8633_9419

20231106 TheStandard_io

20231102 3913Token

20231101 OnyxProtocol

20231031 UniBotRouter

20231028 AstridProtocol

20231024 MaestroRouter2

20231022 OpenLeverage

20230930 FireBirdPair

20230818 ExactlyProtocol

20230814 ZunamiProtocol

20230809 EarningFram

20230802 CurveBurner

20230802 Uwerx

20230801 NeutraFinance

20230723 MintoFinance

20230722 ConicFinance02

20230721 ConicFinance

20230711 RodeoFinance

20230704 BaoCommunity

20230621 BabyDogeCoin02

20230615 DEPUSDT_LEVUSDC

20230612 Sturdy Finance

20230611 SellToken04

20230607 CompounderFinance

20230606 VINU

20230606 UN

20230602 NST SimpleSwap

20230601 DDCoin

20230601 Cellframenet

20230531 ERC20TokenBank

20230529 Jimbo

20230529 BabyDogeCoin

20230415 HundredFinance

20230413 yearnFinance

20230328 SafeMoon Hack

20230328 THENA

20230325 DBW

20230322 BIGFI

20230317 ParaSpace NFT

20230315 Poolz

20230313 EulerFinance

20230218 RevertFinance

20230217 Starlink

20230217 Dexible

20230217 Platypusdefi

20230203 Orion Protocol

20230203 Spherax USDs

20230202 BonqDAO

20230130 BEVO

20230126 TomInu Token

20230119 SHOCO Token

20230119 ThoreumFinance

20230118 QTN Token

20230118 UPS Token

20230117 OmniEstate

20230116 MidasCapital

2022

20221119 AnnexFinance

20221027 Team Finance

20221026 N00d Token

20221025 ULME

20221024 Market

20221024 MulticallWithoutCheck

20221021 OlympusDAO

20221020 HEALTH Token

20221014 EFLeverVault

20221014 MEVBOT a47b

20221012 ATK

20221011 Rabby Wallet SwapRouter

20221011 Templedao

20221010 Carrot

20221009 Xave Finance

20221006 RES-Token

20221002 Transit Swap

20221001 BabySwap

20221001 RL

20221001 Thunder Brawl

20220929 BXH

20220928 MEVBOT Badc0de

20220923 RADT-DAO

20220913 MevBot Private TX

20220910 DPC

20220909 YYDS

20220908 NewFreeDAO

20220908 Ragnarok Online Invasion

20220906 NXUSD

20220905 ZoomproFinance

20220902 ShadowFi

20220902 Bad Guys by RPF

20220828 DDC

20220824 LuckyTiger NFT

20220810 XSTABLE Protocol

20220809 ANCH

20220807 EGD Finance

20220802 Nomad Bridge

20220801 Reaper Farm

20220725 LPC

20220723 Audius

20220713 SpaceGodzilla

20220710 Omni NFT

20220706 FlippazOne NFT

20220701 Quixotic - Optimism NFT Marketplace

20220626 XCarnival

20220624 Harmony's Horizon Bridge

20220618 SNOOD

20220616 InverseFinance

20220608 GYMNetwork

20220608 Optimism - Wintermute

20220606 Discover

20220529 NOVO Protocol

20220524 HackDao

20220517 ApeCoin

20220508 Fortress Loans

20220430 Saddle Finance

20220430 Rari Capital/Fei Protocol

20220428 DEUS DAO

20220424 Wiener DOGE

20220423 Akutar NFT

20220421 Zeed Finance

20220416 BeanstalkFarms

20220415 Rikkei Finance

20220412 ElephantMoney

20220411 Creat Future

20220409 GYMNetwork

20220329 Ronin Network

20220329 Redacted Cartel

20220327 Revest Finance

20220326 Auctus

20220322 CompoundTUSDSweepTokenBypass

20220321 OneRing Finance

20220320 LI.FI

20220320 Umbrella Network

20220315 Agave Finance

20220315 Hundred Finance

20220313 Paraluni

20220309 Fantasm Finance

20220305 Bacon Protocol

20220303 TreasureDAO

20220214 BuildFinance - DAO

20220208 Sandbox LAND

20220205 Meter

20220204 TecraSpace

20220128 Qubit Finance

20220118 Multichain (Anyswap)

2021

20211221 Visor Finance

20211218 Grim Finance

20211214 Nerve Bridge

20211130 MonoX Finance

20211027 Cream Finance

20211015 Indexed Finance

20210916 SushiSwap Miso

20210915 Nimbus Platform

20210915 NowSwap Platform

20210912 ZABU Finance

20210903 DAO Maker

20210830 Cream Finance

20210817 XSURGE

20210811 Poly Network

20210804 WaultFinance

20210728 Levyathan Finance

20210710 Chainswap

20210702 Chainswap

20210628 SafeDollar

20210625 xWin Finance

20210622 Eleven Finance

20210607 88mph NFT

20210603 PancakeHunny

20210527 BurgerSwap

20210519 PancakeBunny

20210508 Rari Capital

20210305 Paid Network

20210204 Yearn YDai

20210125 Sushi Badger Digg

Before 2020

20201229 Cover Protocol

20201121 Pickle Finance

20201026 Harvest Finance

20200804 Opyn Protocol

20200628 Balancer Protocol

20200618 Bancor Protocol

20200419 LendfMe

20200418 UniSwapV1

20180422 Beauty Chain

20171106 Parity - 'Accidentally Killed It'

Transaction debugging tools

List of DeFi Hacks & POCs

20240611 JokInTheBox - business logic flaw

Lost: 9.2 eth

forge test --contracts .\src\test\2024-06\JokInTheBox.sol  -vv --evm-version cancun

Contract

JokInTheBox_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1800355604692910571

20240610 Bazaar - Insufficient Permission Check

Lost: 1.4M

forge test --contracts ./src/test/2024-06/Bazaar_exp.sol -vvv

Contract

Bazaar_exp.sol

Link reference

https://x.com/shoucccc/status/1800353122159833195

20240608 YYStoken - Business Logic Flaw

Lost: $28K

forge test --contracts  src/test/2024-06/YYS_exp.sol -vv

Contract

YYS_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1799610045589831833

20240606 MineSTM - Business Logic Flaw

Lost: $13.8K

forge test --contracts  src/test/2024-06/MineSTM_exp.sol -vv

Contract

MineSTM_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1798920774511898862

20240601 VeloCore - lack-of-access-control

Lost: $6.88M

forge test --contracts  src/test/2024-06/Velocore_exp.sol -vv

Contract

Velocore_exp.sol

Link reference

https://x.com/BeosinAlert/status/1797247874528645333

20240529 SCROLL - Integer Underflow

Lost: 76 ETH

forge test --contracts ./src/test/2024-05/SCROLL_exp.sol -vvv

Contract

SCROLL_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1795650745448169741

20240529 MetaDragon - Lack of Access Control

Lost: ~ $180k

forge test --contracts src/test/2024-05/MetaDragon_exp.sol -vvvvv  --evm-version shanghai

Contract

MetaDragon_exp.sol

Link reference

https://x.com/Phalcon_xyz/status/1795746828064854497

20240527 RedKeysCoin - Weak RNG

Lost: $12K

forge test --contracts ./src/test/2024-05/RedKeysCoin_exp.sol -vvv --evm-version shanghai

Contract

RedKeysCoin_exp.sol

Link reference

20240526 NORMIE - Business Logic Flaw

Lost: $490K

forge test --contracts ./src/test/2024-05/NORMIE_exp.sol -vv

Contract

NORMIE_exp.sol

Link reference

https://x.com/lookonchain/status/1794680612399542672

20240522 Burner - sandwich ack

Lost: 1.7 eth

forge test --contracts ./src/test/2024-05/Burner_exp.sol -vv

Contract

Burner_exp.sol

Link reference

https://x.com/0xNickLFranklin/status/1792925754243625311

20240516 TCH - Signature Malleability Vulnerability

Lost: $18K

forge test --contracts ./src/test/2024-05/TCH_exp.sol -vvv

Contract

TCH_exp.sol

Link reference

https://x.com/DecurityHQ/status/1791180322882629713

20240514 Sonne Finance - Precision loss

Lost: $20M

forge test --contracts ./src/test/2024-05/Sonne_exp.sol -vvv

Contract

Sonne_exp.sol

Link reference

https://neptunemutual.com/blog/taking-a-closer-look-at-sonne-finance-exploit/

20240514 PredyFinance - Reentrancy

Lost: $464K

forge test --contracts ./src/test/2024-05/PredyFinance_exp.sol -vvv

Contract

PredyFinance_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1790307019590680851

20240510 GFOX - lack of access control

Lost: 330K USD

forge test --contracts ./src/test/2024-05/GFOX_exp.sol -vvv --evm-version shanghai

Contract

GFOX_exp.sol

Link reference

https://twitter.com/CertiKAlert/status/1788751142144401886

20240510 TSURU - Insufficient Validation

Lost: 140K

forge test --contracts ./src/test/2024-05/TSURU_exp.sol -vvv --evm-version shanghai

Contract

TSURU_exp.sol

Link reference

https://base.tsuru.wtf/usdtsuru-exploit-incident-report

20240508 GPU - self transfer

Lost: ~32K USD

forge test --contracts src/test/2024-05/GPU_exp.sol -vvv

Contract

GPU_exp.sol

Link reference

https://twitter.com/PeckShieldAlert/status/1788153869987611113

20240507 SATURN - Price Manipulation

Lost: ~15 BNB

forge test --contracts src/test/2024-05/OSN_exp.sol -vvv

Contract

SATURN_exp.sol

Link reference

https://twitter.com/ChainAegis/status/1787667253435195841

20240506 OSN - Reward Distribution Problem

Lost: ~109K USD

forge test --contracts src/test/2024-05/OSN_exp.sol -vvv --evm-version shanghai

Contract

OSN_exp.sol

Link reference

https://twitter.com/SlowMist_Team/status/1787330586857861564

20240430 Yield - Business Logic Flaw

Lost: 181K

forge test --contracts ./src/test/2024-04/Yield_exp.sol -vvv

Contract

Yield_exp.sol

Link reference

https://twitter.com/peckshield/status/1785121607192817692

https://medium.com/immunefi/yield-protocol-logic-error-bugfix-review-7b86741e6f50

20240430 PikeFinance - Uninitialized Proxy

Lost: 1.4M

forge test --contracts ./src/test/2024-04/PikeFinance_exp.sol -vvv

Contract

PikeFinance_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1785508900093194591

20240425 NGFS - Bad Access Control

Lost: ~190K

forge test --contracts ./src/test/2024-04/NGFS_exp.sol -vvv --evm-version shanghai

Contract

NGFS_exp.sol

Link reference

https://twitter.com/CertiKAlert/status/1783476515331616847

20240424 XBridge - Logic Flaw

Lost: >200k USD(plus a lot of STC, SRLTY, Mazi tokens)

forge test --contracts ./src/test/2024-04/XBridge_exp.sol -vvv

Contract

XBridge_exp.sol

20240424 YIEDL - Input Validation

Lost: 150k USD

forge test --contracts ./src/test/2024-04/YIEDL_exp.sol -vvv

Contract

YIEDL_exp.sol

20240422 Z123 - price manipulation

Lost: 136k USD

forge test --contracts ./src/test/2024-04/Z123_exp.sol -vvv

Contract

Z123_exp.sol

Link reference

https://twitter.com/PeckShieldAlert/status/1782322484911784385

20240420 Rico - Arbitrary Call

Lost: 36K

forge test --contracts ./src/test/2024-04/Rico_exp.sol -vvv

Contract

Rico_exp.sol

Link reference

https://twitter.com/ricocreditsys/status/1781803698940781009

20240419 HedgeyFinance - Logic Flaw

Lost: 48M USD

forge test --contracts ./src/test/2024-04/HedgeyFinance_exp.sol -vvv

Contract

HedgeyFinance_exp.sol

Link reference

https://twitter.com/Cube3AI/status/1781294512716820918

20240416 SATX - Logic Flaw

Lost: ~ 50 BNB

forge test --contracts src/test/2024-04/SATX_exp.sol -vvv

Contract

SATX_exp.sol

Link reference

https://x.com/bbbb/status/1780341239801393479

20240416 MARS - Bad Reflection

Lost: >100K

forge test --contracts src/test/2024-04/MARS_exp.sol -vv

Contract

MARS_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1780150315603701933

20240415 Chainge - Input Validation

Lost: ~200K

forge test --contracts ./src/test/2024-04/Chainge_exp.sol -vvv

Contract

Chainge_exp.sol

Link reference

https://twitter.com/CyversAlerts/status/1779875922381860920

20240412 FIL314 - Insufficient Validation And Price Manipulation

Lost: ~14 BNB

forge test --contracts ./src/test/2024-04/FIL314_exp.sol -vvv

Contract

FIL314_exp.sol

Link reference

20240412 SumerMoney - Reentrancy

Lost: 350K

forge test --contracts ./src/test/2024-04/SumerMoney_exp.sol -vvv

Contract

SumerMoney_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1778986926705672698

20240412 GROKD - lack of access control

Lost: $~150 BNB

forge test --contracts ./src/test/2024-04/GROKD_exp.sol -vvv

Contract

GROKD_exp.sol

Link reference

https://x.com/hipalex921/status/1778482890705416323?t=KvvG83s7SXr9I55aftOc6w&s=05

20240409 UPS - business logic flaw

Lost: $~28K USD

forge test --contracts ./src/test/2024-04/UPS_exp.sol -vvv

Contract

UPS_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1777589021058728214

20240408 SQUID - sandwich attack

Lost: $~87K USD

forge test --contracts ./src/test/2024-04/SQUID_exp.sol -vvv

Contract

SQUID_exp.sol

Link reference

https://twitter.com/bbbb/status/1777228277415039304

20240404 wsm - manipulating price

Lost: $~18K USD

forge test --contracts ./src/test/2024-04/WSM_exp.sol -vvv

Contract

WSM_exp.sol

Link reference

https://hacked.slowmist.io/#:~:text=Hacked%20target%3A%20Wall%20Street%20Memes

20240401 ATM - business logic flaw

Lost: $~182K USD

forge test --contracts ./src/test/2024-04/ATM_exp.sol -vvv

Contract

ATM_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1775008489569718508

20240401 OpenLeverage - Reentrancy

Lost: ~234K

forge test --contracts src/test/2024-04/OpenLeverage2_exp.sol -vvv

Contract

OpenLeverage2_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1774727539975672136

20240329 PrismaFi - Insufficient Validation

Lost: $~11M

forge test --contracts ./src/test/2024-03/Prisma_exp.sol -vvv

Contract

Prisma_exp.sol

Link reference

https://twitter.com/EXVULSEC/status/1773371049951797485

20240328 LavaLending - Business Logic Flaw

Lost: ~340K

forge test --contracts src/test/2024-03/LavaLending_exp.sol -vvv

Contract

LavaLending_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1774727539975672136

https://twitter.com/Phalcon_xyz/status/1773546399713345965

https://hackmd.io/@LavaSecurity/03282024

20240325 ZongZi - Price Manipulation

Lost: ~223K

forge test --contracts src/test/2024-03/ZongZi_exp.sol -vvv

Contract

ZongZi_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1772195949638775262

20240321 SSS - Token Balance Doubles on Transfer to self

Lost: 4.8M

forge test --contracts ./src/test/2024-03/SSS_exp.sol -vvv

Contract

SSS_exp.sol

Link reference

https://twitter.com/dot_pengun/status/1770989208125272481

20240324 ARK - business logic flaw

Lost: ~348BNB

forge test --contracts src/test/2024-03/ARK_exp.sol -vvv

Contract

ARK_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1771728823534375249

20240320 Paraswap - Incorrect Access Control

Lost: ~24K

forge test --contracts src/test/2024-03/Paraswap_exp.sol -vvv --evm-version shanghai

Contract

Paraswap_exp.sol

Link reference

https://medium.com/neptune-mutual/analysis-of-the-paraswap-exploit-1f97c604b4fe

20240314 MO - business logic flaw

Lost: ~413k USDT

forge test --contracts src/test/2024-03/MO_exp.sol -vvv

Contract

MO_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1768184024483430523

20240313 IT - business logic flaw

Lost: ~13k USDT

forge test --via-ir  --contracts src/test/2024-03/IT_exp.sol -vvv

Contract

IT_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1768171595561046489

20240309 Juice - Business Logic Flaw

Lost: ~54 ETH

forge test --contracts ./src/test/2024-03/Juice_exp.sol -vvv

Contract

Juice_exp.sol

Link reference

https://medium.com/@juicebotapp/juice-staking-exploit-next-steps-95e218b3ec71

20240309 UnizenIO - unverified external call

Lost: ~2M

forge test --contracts src/test/2024-03/UnizenIO_exp.sol -vvvv

Contract

UnizenIO_exp.sol | UnizenIO2_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1766274000534004187

https://twitter.com/AnciliaInc/status/1766261463025684707

20240307 GHT - Business Logic Flaw

Lost: ~57K

forge test --contracts ./src/test/2024-03/GHT_exp.sol -vvv

Contract

GHT_exp.sol

Link reference

20240306 ALP - Public internal function

Lost: ~10K

Testing

forge test --contracts ./src/test/2024-03/ALP_exp.sol -vvv

Contract

ALP_exp.sol

Link Reference

https://twitter.com/0xNickLFranklin/status/1765296663667875880

20240306 TGBS - Business Logic Flaw

Lost: ~150K

forge test --contracts ./src/test/2024-03/TGBS_exp.sol -vvv

Contract

TGBS_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1765290290083144095

https://twitter.com/Phalcon_xyz/status/1765285257949974747

20240305 Woofi - Price Manipulation

Lost: ~8M

forge test --contracts ./src/test/2024-03/Woofi_exp.sol -vvv

Contract

Woofi_exp.sol

Link reference

https://twitter.com/spreekaway/status/1765046559832764886 https://twitter.com/PeckShieldAlert/status/1765054155478175943

20240228 Seneca - Arbitrary External Call Vulnerability

Lost: ~6M

forge test --contracts ./src/test/2024-02/Seneca_exp.sol -vvv

Contract

Seneca_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1763045563040411876

20240228 SMOOFSStaking - Reentrancy

Lost: Unclear

forge test --contracts ./src/test/2024-02/SMOOFSStaking_exp.sol -vvv

Contract

SMOOFSStaking_exp.sol

Link reference

https://twitter.com/AnciliaInc/status/1762893563103428783

https://twitter.com/0xNickLFranklin/status/1762895774311178251

20240223 CompoundUni - Oracle bad price

Lost: ~439,537 USD

forge test --contracts ./src/test/2024-02/CompoundUni_exp.sol -vvv

Contract

CompoundUni_exp.sol

Link reference

https://twitter.com/0xLEVI104/status/1762092203894276481

20240223 BlueberryProtocol - logic flaw

Lost: ~1,400,000 USD

forge test --contracts ./src/test/2024-02/BlueberryProtocol_exp.sol -vvv

Contract

BlueberryProtocol_exp.sol

Link reference

https://twitter.com/blueberryFDN/status/1760865357236211964

20240221 DeezNutz 404 - lack of validation

Lost: ~170k

forge test --contracts ./src/test/2024-02/DeezNutz404_exp.sol -vvv

Contract

DeezNutz404_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1760481343161700523

20240221 GAIN - bad function implementation

Lost: ~6.4 ETH

forge test --contracts ./src/test/2024-02/GAIN_exp.sol -vvv

Contract

GAIN_exp.sol

Link reference

https://twitter.com/0xNickLFranklin/status/1760559768241160679

20240219 RuggedArt - reentrancy

Lost: ~10k

forge test --contracts ./src/test/2024-02/RuggedArt_exp.sol -vvv

Contract

RuggedArt_exp.sol

Link reference

https://twitter.com/EXVULSEC/status/1759822545875025953

20240216 ParticleTrade - lack of validation data

Lost: ~50k

forge test --contracts ./src/test/2024-02/ParticleTrade_exp.sol -vvv

Contract

ParticleTrade_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1758028270770250134

20240215 DualPools - precision truncation

Lost: ~42k

forge test --contracts ./src/test/2024-02/DualPools_exp.sol -vvvv

Contract

DualPools_exp.sol

Link reference

https://medium.com/@lunaray/dualpools-hack-analysis-5209233801fa

20240215 Miner - lack of validation dst address

Lost: ~150k

forge test --contracts ./src/test/2024-02/Miner_exp.sol -vvv --evm-version shanghai

Contract

Miner_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1757777340002681326

20240211 Game - Reentrancy && Business Logic Flaw

Lost: ~20 ETH

forge test --contracts ./src/test/2024-02/Game_exp.sol -vvv

Contract

Game_exp.sol

Link reference

https://twitter.com/AnciliaInc/status/1757533144033739116

20240210 FILX DN404 - Access Control

Lost: 200K

forge test --contracts ./src/test/2024-02/DN404_exp.sol -vvv

Contract

DN404_exp.sol

20240208 Pandora - interger underflow

Lost: ~17K USD

forge test --contracts ./src/test/2024-02/PANDORA_exp.sol -vvv

Contract

PANDORA_exp.sol

Link reference

https://twitter.com/pennysplayer/status/1766479470058406174

20240205 BurnsDefi - Price Manipulation

Lost: ~67K

forge test --contracts ./src/test/2024-02/BurnsDefi_exp.sol -vvv

Contract

BurnsDefi_exp.sol

Link reference

https://twitter.com/pennysplayer/status/1754342573815238946

https://medium.com/neptune-mutual/how-was-citadel-finance-exploited-a5f9acd0b408 (similar incident)

20240201 AffineDeFi - lack of validation userData

Lost: ~88K

forge test --contracts ./src/test/2024-02/AffineDeFi_exp.sol -vvv

Contract

AffineDeFi_exp.sol

Link reference

https://twitter.com/Phalcon_xyz/status/1753020812284809440

https://twitter.com/CyversAlerts/status/1753040754287513655

20240130 MIMSpell - Precission Loss

Lost: ~6,5M

forge test --contracts ./src/test/2024-01/MIMSpell2_exp.sol -vvv

Contract

MIMSpell2_exp.sol

Link reference

https://twitter.com/kankodu/status/1752581744803680680

https://twitter.com/Phalcon_xyz/status/1752278614551216494

https://twitter.com/peckshield/status/1752279373779194011

https://phalcon.blocksec.com/explorer/security-incidents

20240128 BarleyFinance - Reentrancy

Lost: ~130K

forge test --contracts ./src/test/2024-01/BarleyFinance_exp.sol -vvv

Contract

BarleyFinance_exp.sol

Link reference

https://phalcon.blocksec.com/explorer/security-incidents

https://www.bitget.com/news/detail/12560603890246

https://twitter.com/Phalcon_xyz/status/1751788389139992824

20240127 CitadelFinance - Price Manipulation

Lost: ~93K

forge test --contracts ./src/test/2024-01/CitadelFinance_exp.sol -vvv

Contract

CitadelFinance_exp.sol

Link reference

https://medium.com/neptune-mutual/how-was-citadel-finance-exploited-a5f9acd0b408

20240125 NBLGAME - Reentrancy

Lost: ~180K

forge test --contracts ./src/test/2024-01/NBLGAME_exp.sol -vvv

Contract

NBLGAME_exp.sol

Link reference

https://twitter.com/SlowMist_Team/status/1750526097106915453

https://twitter.com/AnciliaInc/status/1750558426382635036

20240122 DAO_SoulMate - Incorrect Access Control

Lost: ~319K

forge test --contracts ./src/test/2024-01/DAO_SoulMate_exp.sol -vvv --evm-version 'shanghai'

Contract

DAO_SoulMate_exp.sol

Link reference

https://twitter.com/MetaSec_xyz/status/1749743245599617282

20240117 BmiZapper - Arbitrary external call vulnerability

Lost: ~114K

forge test --contracts ./src/test/2024-01/Bmizapper_exp.sol -vvv

Contract

BmiZapper_exp.sol

Link reference

https://x.com/0xmstore/status/1747756898172952725

20240112 SocketGateway - Lack of calldata validation

Lost: ~3.3Million $

forge test --contracts ./src/test/2024-01/SocketGateway_exp.sol -vvv --evm-version shanghai

Contract

SocketGateway_exp.sol

Link reference

https://twitter.com/BeosinAlert/status/1747450173675196674

https://twitter.com/peckshield/status/1747353782004900274

20240112 WiseLending - Bad HealthFactor Check

Lost: ~464K

forge test --contracts ./src/test/2024-01/WiseLending02_exp.sol -vvv --evm-version shanghai

Contract

WiseLending02_exp.sol

Link reference

https://twitter.com/danielvf/status/1746303616778981402

20240110 LQDX - Unauthorized TransferFrom

Lost: unknown

forge test --contracts src/test/2024-01/LQDX_alert_exp.sol -vvv

Contract

LQDX_alert_exp.sol

Link reference

https://twitter.com/SlowMist_Team/status/1744972012865671452

20240104 Gamma - Price manipulation

Lost: ~6.3M

forge test --contracts ./src/test/2024-01/Gamma_exp.sol -vvv

Contract

Gamma_exp.sol

Link reference

https://twitter.com/officer_cia/status/1742772207997050899

https://twitter.com/shoucccc/status/1742765618984829326

20240102 MIC - Business Logic Flaw

Lost: ~500K

forge test --contracts ./src/test/2024-01/MIC_exp.sol -vvv

Contract

MIC_exp.sol

Link reference

https://x.com/MetaSec_xyz/status/1742484748239536173

20240102 RadiantCapital - Loss of Precision

Lost: ~4,5M

forge test --contracts ./src/test/2024-01/RadiantCapital_exp.sol -vvv

Contract

RadiantCapital_exp.sol

Link reference

https://neptunemutual.com/blog/how-was-radiant-capital-exploited/

https://twitter.com/BeosinAlert/status/1742389285926678784

20240101 OrbitChain - Incorrect input validation

Lost: ~81M

forge test --contracts ./src/test/2024-01/OrbitChain_exp.sol -vvv

Contract

OrbitChain_exp.sol

Link reference

https://blog.solidityscan.com/orbit-chain-hack-analysis-b71c36a54a69

View Gas Reports

Foundry also has the ability to report the gas used per function call which mimics the behavior of hardhat-gas-reporter. Generally speaking if gas costs per function call is very high, then the likelihood of its success is reduced. Gas optimization is an important activity done by smart contract developers.

Every poc in this repository can produce a gas report like this:

forge test --gas-report --contracts <contract> -vvv

For Example: Let us find out the gas used in the Audius poc

Execution

forge test --gas-report --contracts ./src/test/Audius.exp.sol -vvv

Demo

Bug Reproduce

Moved to DeFiVulnLabs

FlashLoan Testing

Moved to DeFiLabs

Files

README.md

Latest commit

History

README.md

File metadata and controls

DeFi Hacks Reproduce - Foundry

Getting Started

Web3 Cybersecurity Academy

OnChain transaction debugging

Who Support Us? DeFiHackLabs Received Grant From

Donate us

List of Past DeFi Incidents

Transaction debugging tools

Ethereum Signature Database

Useful tools

Hacks Dashboard

List of DeFi Hacks & POCs

20240611 JokInTheBox - business logic flaw

Lost: 9.2 eth

Contract

Link reference

20240610 Bazaar - Insufficient Permission Check

Lost: 1.4M

Contract

Link reference

20240608 YYStoken - Business Logic Flaw

Lost: $28K

Contract

Link reference

20240606 MineSTM - Business Logic Flaw

Lost: $13.8K

Contract

Link reference

20240601 VeloCore - lack-of-access-control

Lost: $6.88M

Contract

Link reference

20240529 SCROLL - Integer Underflow

Lost: 76 ETH

Contract

Link reference

20240529 MetaDragon - Lack of Access Control

Lost: ~ $180k

Contract

Link reference

20240527 RedKeysCoin - Weak RNG

Lost: $12K

Contract

Link reference

20240526 NORMIE - Business Logic Flaw

Lost: $490K

Contract

Link reference

20240522 Burner - sandwich ack

Lost: 1.7 eth

Contract

Link reference

20240516 TCH - Signature Malleability Vulnerability

Lost: $18K

Contract

Link reference

20240514 Sonne Finance - Precision loss

Lost: $20M

Contract

Link reference

20240514 PredyFinance - Reentrancy

Lost: $464K

Contract

Link reference

20240510 GFOX - lack of access control

Lost: 330K USD

Contract

Link reference

20240510 TSURU - Insufficient Validation

Lost: 140K

Contract

Link reference

20240508 GPU - self transfer

Lost: ~32K USD