Skip to main contentThis section analyzes real-world hacks and demonstrates how assertions could have prevented them. These case studies provide concrete examples of how assertions work as a safety net, catching vulnerabilities that might slip through traditional security measures like audits and testing.
Each analysis includes:
- Detailed explanation of the attack mechanism
- Root cause analysis of the vulnerability
- Specific assertion code that would have prevented the exploit
Access Control & Administrative Vulnerabilities
Attack Type: Ownership Takeover
Loss: $58M+ USD
Root Cause: Attackers gained control of multisig signers and changed ownership of lending pools
Prevention: Owner change assertions with proper validation and whitelisting
Attack Type: UI Compromise + Implementation Change
Loss: $1.4B USD
Root Cause: Compromised frontend showed fake transactions while changing proxy implementation
Prevention: Implementation address change assertions and transaction validation
Attack Type: Private Key Compromise + Multisig Manipulation
Loss: $39.3M USD
Root Cause: Compromised private keys enabled rapid multisig reconfiguration and threshold reduction
Prevention: Threshold protection assertions, owner whitelisting, and cooling periods
Arithmetic & Calculation Errors
Attack Type: Rounding Error Exploitation
Loss: $6.5M USD
Root Cause: Rounding error in RebaseToken mechanism allowed base value inflation
Prevention: Invariant checks ensuring debt shares consistency
Attack Type: Rounding Error + Liquidity Manipulation
Loss: $8.4M USD
Root Cause: Rounding error in withdrawal mechanism led to disproportionate liquidity decreases
Prevention: Withdrawal proportionality assertions ensuring balance decreases match share burns
Attack Type: Rounding Error Accumulation
Loss: $120M+ USD
Root Cause: Accumulated rounding errors in stable pool invariant calculation manipulated exchange rates
Prevention: Rate change bounds assertions detecting drastic pool rate changes within single transactions
Attack Type: Logic Error in Upgrade
Loss: $280K USD (limited by quick response)
Root Cause: One-letter bug (> instead of >=) in reward calculation
Prevention: Maximum reward rate validation assertions
Attack Type: Unchecked State Flag
Loss: Protocol drained
Root Cause: Missing validation of isActive flag in unstake function
Prevention: State flag validation assertions
Oracle & Price Manipulation
Attack Type: Price Manipulation
Loss: $130M USD
Root Cause: Sudden price manipulation through asset donation to vault
Prevention: Price deviation monitoring assertions
Attack Type: Access Control + Price Manipulation
Loss: $7.5M USD
Root Cause: Lack of access controls in MinimalForwarder allowed price manipulation
Prevention: Price deviation assertions and access control validation
Attack Type: Reentrancy + AUM Manipulation
Loss: $42M USD
Root Cause: Reentrancy vulnerability allowed artificial AUM inflation
Prevention: AUM manipulation bounds assertions and atomic state consistency
Protocol Logic Vulnerabilities
Attack Type: Missing Health Check
Loss: $197M USD
Root Cause: Donation function lacked health factor validation
Prevention: Health factor assertions after all state changes
Attack Type: Share Price Manipulation
Loss: Various protocols affected
Root Cause: First depositor can manipulate exchange rate through donation
Prevention: Minimum supply assertions and exchange rate validation
Attack Type: Unrestricted Token Minting
Loss: Protocol funds
Root Cause: Anyone could mint reward tokens without proper validation
Prevention: Collateralization ratio assertions 
