Every DeFi hack.Its root cause.Its lesson web3.s0sta.com/research/ --------- #Web3 #Web3Community

DFS — fee-on-transfer + skim loop 2022-12 · BSC THE INCIDENT Flash-swap the pair's USDT, then flash-swap half the DFS reserve; donate DFS back (98% then 95%) and loop 12 `skim(pair)` calls plus a final `skim(attacker)`, each triggering DFS's fee-on-transfer on the pair, then swap USDT out at the skewed price and repay with 0.5% fee. THE LESSON Fee-on-transfer + skim loops skew reserves in the attacker's favor — audit fee logic for per-transfer burns. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #Security

BGLD — migration pricing + skim manipulation 2022-12 · BSC THE INCIDENT Flashloan WBNB; the attacker donates to and skims the oldBGLD pair to pump its price, calls `Proxy.migrate()` converting oldBGLD→newBGLD at the manipulated rate, flashloans DEBT to repeat the skim trick on the oldBGLD/DEBT pair, and finally sells newBGLD/DEBT into USDT. THE LESSON Token migration functions must not use manipulable spot prices — snapshots or TWAPs only. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #Security

BBOX — tokenomics (sell-limit bypass via helper contract) 2022-12 · BSC THE INCIDENT Flashloan WBNB, buy BBOX through a fresh `TransferBBOXHelp` contract to dodge the token's sell-time limits, have the helper transfer the BBOX back, then sell 90% for WBNB — profiting from the fee/limit asymmetry. THE LESSON Sell limits keyed per address are bypassed with fresh contracts — enforce limits at the pair/tokenomics level. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #Security

APC — oracle manipulation (transSwap off live pair) 2022-12 · BSC THE INCIDENT Flashloan 500k USDT, pump the APC price on PancakeSwap, then `transSwap.swap(APC → MUSD)` prices the swap off the pumped pair and hands out excess MUSD; the attacker dumps APC, swaps MUSD back to APC at normal price and sells again. THE LESSON In-house swap contracts reading live pair reserves are arbitrage engines for flashloan pump-and-dump sequences. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #OracleManipulation #DeFi #SmartContract #Security

AES — fee-on-transfer + skim manipulation 2022-12 · BSC THE INCIDENT Flashloan 100k USDT, buy AES, donate half to the pair, then `skim(pair)` 37 times to trigger AES's transfer-fee side effects on the pair balance, call `distributeFee()`, sync, and sell AES back at the inflated price. THE LESSON Skim loops + fee-distribution functions on fee-on-transfer tokens are a repeatable manipulation recipe. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #Security

UEarn Pool — referral / reward logic (tier farming) + flashloan 2022-11 · BSC THE INCIDENT 22 fresh contracts are bound in a referral chain; the attacker flashloans 2.42M USDT and the last contract stakes 2.4M USDT to reach the top team tier, then each contract stakes 20k and claims the tiered team reward (up to 162k USDT total per level), withdrawing to the attacker and repaying the loan. THE LESSON Tiered referral rewards are farmable with flashloaned stake and fresh-address chains — require locked, time-bound team amounts. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #Security

Sheep Farm — logic (referral spam) 2022-11 · BSC THE INCIDENT Same Sheep Farm bug exploited with 4 fresh contracts that each register the neighbor 402 times, add gems, upgrade, sell and withdraw 156,000 wool, then selfdestruct the funds back to the attacker. THE LESSON Same lesson as SheepFarm_exp.sol — fresh contracts multiply the referral spam until limits are enforced. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #LogicFlaw #SmartContract #DeFi #Security

Hackathon (double-credit transfer) — logic flaw (sender==recipient==pair double-credits balance) 2024-04 · BSC THE INCIDENT The Hackathon token's transfer credits the recipient twice when sender == recipient == pair. The attacker flashloans 200K BUSD and loops 10×: swap BUSD→Hackathon, transfer the whole balance directly to the pair (double-credit inflates the pair's real balance beyond reserves), skim the phantom surplus, and sell the remaining Hackathon back to BUSD (~$20K). THE LESSON Transfer implementations that special-case address equality are a bug magnet — the pair-address branch must credit exactly once, or skim() becomes a printer. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #securityangel

Sheep Farm — logic (referral spam) 2022-11 · BSC THE INCIDENT The attacker calls `register(neighbor)` 200 times in a loop, adds gems, upgrades villages, sells the village, and withdraws 20,000 wool — each register call credits team/referral rewards to the attacker without any anti-spam bound. THE LESSON Referral registration must be idempotent or bounded — unbounded register loops farm team rewards. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #LogicFlaw #SmartContract #DeFi #Security

SEAMAN — tokenomics (dividend-on-transfer) 2022-11 · BSC THE INCIDENT Flashloan 800k USDT, buy SEAMAN and GVC; the attacker loops 20 transfers of 1 SEAMAN to the pair, and each transfer triggers SEAMAN's fee logic which pays dividends in GVC to holders — the attacker then sells the farmed GVC for USDT and repays. THE LESSON Dividend-on-transfer tokens pay out during attacker-triggered transfers — model transfer fees as a farming loop. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #Security

SDAO — reward accounting manipulation 2022-11 · BSC THE INCIDENT Flashloan 500 USDT, buy SDAO, add LP and stake half; transferring SDAO to the pair raises `totalStakeReward` above `lastTotalStakeReward`, and `withdrawTeam(pair)` further skews the accounting — so `getReward()` pays out inflated rewards that the attacker dumps for USDT. THE LESSON Reward accumulators driven by pair transfers (totalStakeReward) are manipulable by donations — snapshot rewards at deposit time. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #Security

Polynomial — arbitrary external call (swapTarget in zap) 2022-11 · Optimism THE INCIDENT `swapAndDeposit(user=victim, token=ETH, depositToken=attacker, swapTarget=USDC, swapData=transferFrom(victim→attacker))` — the zap executes the attacker's swapData against the attacker-chosen target, draining five victims' USDC allowances. THE LESSON Zap functions must whitelist swap targets and ignore attacker-controlled calldata destinations. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #SmartContract #DeFi #Blockchain #Security

MEV Bot 0x0ad8 — access-control (bot executes attacker calldata) 2022-11 · Ethereum THE INCIDENT Calling the bot's function `0x090f88ca` with attacker-crafted calldata makes it execute `transferFrom(victim → attacker)` for a victim's full USDC balance, using the bot's pre-existing allowances. THE LESSON MEV bots with standing approvals and unauthenticated entry points are free transferFrom machines — validate callers. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #AccessControl #SmartContract #DeFi #Security

Kashi (Abracadabra) — logic (self-liquidation + exchange-rate update) 2022-11 · Ethereum THE INCIDENT Flashloan 450k xSUSHI from BentoBox, deposit it as Cauldron collateral, borrow 800k MIM, call `updateExchangeRate()` to reprice, then liquidate their own position — taking the collateral while leaving bad debt — and repay the flashloan with profit. THE LESSON Self-liquidation combined with in-tx exchange-rate updates can walk off with collateral — check for bad-debt invariants on liquidation. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #Security

DFX Finance — flash-accounting (deposit during flash callback) 2022-11 · Ethereum THE INCIDENT The attacker calls `dfx.flash()` with 99.5% of the pool's XIDR/USDC and, inside `flashCallback`, calls `dfx.deposit(200k)` while the flash accounting is in-flight — the deposit is priced against pre-flash state, minting LP too cheaply; after the flash they `withdraw` the LP and sell the proceeds. THE LESSON Flash-loan callbacks that permit deposit/withdraw re-entry against in-flight state are exploitable — lock state during flash. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #FlashLoan #DeFi #SmartContract #Security

Brahma (BrahmaTOPGE) — arbitrary external call (zapIn swapTarget) 2022-11 · Ethereum THE INCIDENT `Zapper.zapIn` executes caller-supplied `swapTarget`/`callData`; the attacker sets swapTarget = USDC and callData = `transferFrom(victim → attacker)` for a victim who had approved the zapper, draining their USDC. THE LESSON Zap-in functions must whitelist swap targets — arbitrary callData on user-approved spenders is an allowance drain. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #SmartContract #DeFi #Blockchain #Security

BDEX — logic (public harvest on skewed reserves) 2022-11 · BSC THE INCIDENT The attacker deposits 34 WBNB into the BDEX pair and manually swaps out BDEX, then calls the vault strategy's `convertDustToEarned()` which harvests against the skewed reserves, and sells the BDEX back for more WBNB than spent. THE LESSON Public harvest/convert functions that read live pool reserves can be triggered at attacker-chosen skew moments. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #LogicFlaw #SmartContract #DeFi #Security

Annex — access-control (liquidation helper executes attacker swaps) 2022-11 · BSC THE INCIDENT The attacker deploys a worthless token, adds its LP with 8 flashloaned WBNB, then flash-swaps WBNB into the Annex `Liquidator` contract, whose logic (triggered by the swap) grants the attacker a transferFrom; the attacker pulls the liquidator's WBNB balance and removes liquidity. THE LESSON Liquidation helpers that react to attacker-supplied pair swaps can be coerced into transferring out their own funds. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #AccessControl #SmartContract #DeFi #Security

AUR — access-control (public reward setters) 2022-11 · BSC THE INCIDENT `changeNodePrice` and `changeRewardPerNode` on the AurumNodePool are public; the attacker sets both to astronomical values, creates a node, rolls/warps time forward and claims the inflated node reward, then dumps AUR for BNB. THE LESSON Node-reward rate and price setters must be owner-only — public setters turn rewards into faucets. Full analysis: s0sta.com/DeFi-Hacks-Reprodu… #AccessControl #SmartContract #DeFi #Security