Blog
Research reports
In-depth security reports, incident analyses, and industry research covering the state of Web3 security.
Incident analysisSneaky Sandwich Exploit: The BabyDoge Attack Caused 442 BNB LossOn Jun 21, 2023, BabyDoge was attacked, leading to a loss of 442 BNB. The attacker made use of a contract that could waive the fee and performed a sandwich attack.- Incident analysisMultichain Collapse: The Private Key Leak That Drained $125M+On July 6, 2023, the cross-chain bridge protocol Multichain experienced large unauthorized withdrawals, suggesting a likely Private Key issue.
- Incident analysisStablecoin Stumble: The Code Bug Led to $6.5 Million Loss on DeuS FinanceOn May 5th, 2023, the Deus stablecoin was attacked due to issues within its code logic, leading to a loss of $6,500,000.
- Incident analysisPost Mortem: SafemoonOn Mar 28th, 2023, the Safemoon token contract was attacked, leading to a loss of $8.9M. The attacker took advantage of the public burn function and drained funds from the LP pool.
- Incident analysisPost Mortem: TelcoinOn Dec 26th, 2023, Telcoin experienced a loss of ~$1.25M attack. The vulnerable contract is due to a vulnerability in the proxy implementation of wallet contracts, which is a different application from what CertiK has audited.
- Incident analysisPost Mortem: Onyx ProtocolOn Nov 1, 2023, Onyx Protocol was attacked, leading to a loss of around $2.1M. The Onyx team added a new PEPE market without any initial funds, so the hacker was able to manipulate the exchange rate of the PEPE market and borrow assets from other Onyx markets, also got back all the collateral due to rounding errors in solidity, causing bad debts in these markets.
This vulnerability was identified in CertiK's audit report, and CertiK recommended that the project team add a new contract capable of minting fresh shares when the contract is deployed. The Onyx team acknowledged this issue and decided not to perform any action on the contract.
- Incident analysisPost Mortem: HashflowOn June 14th, 2023, Hashflow experienced a loss of ~$605k across five chains. The vulnerable contract is unverified and the vulnerable `0x1ce5` function contains a `transferFrom` function the attacker could trigger to steal user funds when approved. The vulnerable function was absent from the audited codebase, it is out of the audit scope.
- Incident analysisPost Mortem: BiSwapOn June 30th, 2023, the liquidity migrator contract of Biswap, for migrating liquidity from v2 to v3, was exploited. The vulnerable code is located on the `MigratorV3` contract, which is not audited by Certik.
- Incident analysisPost Mortem: DefiLabsOn July 27th, 2023, DefiLabs was rug-pulled by a privileged function in the `vPoolv6` contract, which is not audited by Certik.
Incident analysisTime Token ExploitOn 7 December TIME token was exploited leading to a loss of 89.5 ETH. The exploiter was able to burn a majority of TIME tokens via the vulnerable Forwarder contract entrusted to execute a transaction from an arbitrary sender address.
Incident analysisKyberSwap Elastic On Nov 22nd (+UTC) 2023, KyberNetwork suffered multiple flashloan exploits across several chains resulting in a loss of ~$47M worth of assets.
Incident analysisHeco Bridge ExploitOn 22 November, another major private key compromise affected the Heco Bridge and HTX hot wallets amounting to \$116 million in losses. A malicious actor compromised several wallets belonging to HTX as well as the Heco bridge operator wallet, allowing them to withdraw withdraw assets on Ethereum and TRON. We have also identified a suspicious movement of Bitcoin. This brings the total lost to private key compromises this year to over \$800 million, representing 56% of all funds lost in 2023. This incident is also the fifth largest incident in 2023 and is the largest bridge attack this year.