Blog
Research reports
In-depth security reports, incident analyses, and industry research covering the state of Web3 security.
Incident analysisAping Peril: The Price Manipulation Exploit with ParaSpaceOn March 17, 2023, a vulnerability located in the AutoCompoundApe contract of the ParaSpace protocol was exploited by a price manipulation attack.- Incident analysisInflated Books: The $250K Attack on Sperax USDOn Feb 4, 2023, SperaxUSD was attacked, leading to a loss of $250K due to the incorrect logic in its Migration/Rebasing Mechanism.
- Incident analysisPost Mortem: TerraPort FinanceOn April 10th, 2023, the Terraport project team was alarmed breach detected with the Terraport Liquidity wallet. The total loss is around $4M.
- Incident analysisEarnings Misconfigured: Yearn.finance Exploit ExplainedOn April 13, 2023, yearn.finance was attacked due to a misconfiguration of the yUSDT contract, leading to a loss of approximately $10M.
- Incident analysisPost Mortem: SushiswapOn April 9th, 2023, the RouteProcessor2 in Sushiswap was exploited due to missing validation on the input with processRoute function. The total loss is around $ 3.3 M.
- Incident analysisHunting Orion: The $3M Loss from a Reentrancy AttackOn Feb 2, 2023, the Orion Protocol was exploited for $3M due to a reentrancy attack targeting the exchange contract.
- Incident analysisMasterChef Mischief: Examining the Rug Pull in Swaprum ProtocolOn May 18, 2023, the Swaprum protocol deployer rug pulled by upgrading the contract “MasterChef” contract to the malicious version and withdrew a significant quantity of LP tokens that staked inside the contract and mint a large amount of Swaprum token to drain the pool.
- Incident analysisPost Mortem: Thoreum FinanceOn Jan 18, 2023, Thoreum Finance's token contract v4 was exploited, leading to a loss of around 2,260 WBNB. The attacker took advantage of the flawed implementation in the token contract's transfer function and manipulated its balance.
- Incident analysisPost Mortem: FintochOn May 5th, 2023, the Fintoch was rugpulled, leading to a loss of ~$31.6M.
- Incident analysisSlippery Rug: The Uncontrolled Launch of SmashcashOn Feb 13, 2023, Smashcash was reported with a potential rug pull implanted within the initial token distribution, where the wallets that received the initial distribution sold the tokens for ~45.6 BNB.
- Incident analysisunshETH Private Key Slip: $375,000 Loss from a Github PostOn Jun 01, 2023, the staking platform unshETH was attacked, leading to a loss of around $375,000.
- Incident analysisLending Rate Manipulation: Investigating the FilDA Finance AttackOn April 22, 2023, FilDA Finance was attacked, leading to a loss of around $700K. The attacker manipulated the exchange rate in the lending pool and drained funds from it.