Blog
Research reports
In-depth security reports, incident analyses, and industry research covering the state of Web3 security.
Incident analysisCUT Token Incident AnalysisOn 10th September, 2024, Caterpillar Coin ($CUT token) suffered a flashloan attack resulting in a loss of ~$1.4M and causing a 99% slippage on the token. The attack exploited vulnerabilities in the ‘price protection mechanisms’, which led to the manipulation of token reserves and rewards.
Incident analysisVow Incident AnalysisOn 12 August 2024, VOW token was exploited for around $1.2 million. The usdRateSetter address (0xbA1be907f532Ff6bb0088279e0f3DCDdD693aC7c) in the VOW contract temporarily changed the exchange rate (usdRate) between VOW and vUSD from 1 to 100. A malicious actor exploited the new usdRate to obtain vUSD at 100 times the correct amount. 
Incident analysisUtopiaSphere Incident AnalysisOn 21 July 2024, UtopiaSphere token UPS was exploited for ~$521K via a flash loan exploit. The exploiter used flash loaned funds in order to manipulate the token price of UPS by taking advantage of the project’s swapBurn() mechanism which burns a portion of UPS when selling. The UPS/USDT pair has remained empty and inactive since the exploit.
Incident analysisDough Finance Incident AnalysisOn 12 July 2024, Dough Finance was exploited for ~$2.1m via multiple flash loan transactions. The attacker exploited arbitrary call vulnerabilities in the Dough ConnectorDeleverageParaswap contracts which allowed them to transfer WETH directly from these vulnerable contracts.
Incident analysisYOLO Games (Bazaar) Incident AnalysisOn 10 June 2024, YOLO Games announced via their X account that a security vulnerability had been reported on the Bazaar LBP contract. As a consequence the YOLO LBP sale was ended early and users holding rYOLO would be refunded. 
Incident analysisThe Memecoin Markets of SpringfieldA serial rug puller on Solana executed 64 exit scams in under 24 hours, but lost money on more than 95% of them. We analyze their operation through a Simpsons lens.
Industry researchFIT21 For Purpose: What the U.S. Congress’s New Bill Means for Crypto ComplianceLast week, the U.S. House of Representatives passed the Financial Innovation and Technology for the 21st Century Act, known as FIT21. Here's what it means for crypto compliance
Incident analysisNormie Incident AnalysisOn 26 May 2024, an attacker exploited a vulnerability in the NORMIE contract on Base blockchain, executing a flash loan attack that significantly increased the meme coin’s token supply. This exploit resulted in a 99% drop in the token’s value, causing the market cap to crash from approximately $41 million to around $35k. The attacker gained 224 WETH (~$881,686) of which they offered to return 90%, provided certain stipulations were met. 
Incident analysisPike Finance Incident AnalysisOn 26 April Pike Finance was exploited for $299k. As a result of the exploit they paused their contract which required it to be upgraded first. The upgrade caused a knock on effect and on 30 April 2024 Pike Finance was exploited for a second time with approximate losses of $1.68m.
Incident analysisAlex Bridge Incident AnlaysisOn 14th May, CertiK’s internal alerting system detected a suspicious transfer of $4.3 million worth of assets to a wallet on the Binance Smart Chain, with an additional 13.7 million STX worth $2 million that was transferred to a malicious address. The incident was due to a private key compromise of the project’s deployer which has been confirmed by the project since the attack. The funds that were affected on BSC were front run by a wallet who has begun negotiations to return the assets to the project. At the time of writing, the funds affected total $6.3 million.
Incident analysisSonne Finance Incident AnalysisOn 14 May 2024, Sonne Finance was exploited for approximately $20M with a known precision loss vulnerability that was first seen in the Hundred Finance exploit in April 2023. The Sonne Finance exploit is the largest exploit to occur on the Optimism chain and is overall the 6th largest incident in 2024. The attacker took advantage of the known vulnerability when an empty pool had been newly created, after users voted to add Velo token to Sonne on the Optimism chain. 
Incident analysisTax-Free Fraud: Exposing the ZhongHua ScamThe ZongHua exit scam resulted from the team's deliberate exemption of privileged addresses from balance checks, allowing them to mint huge amounts of tokens and dump them. We investigate how this happened.