Previous Hacks Assertions
Previous Hacks Index
Real-world hacks and how assertions could have prevented them
This section analyzes real-world hacks and demonstrates how assertions could have prevented them. These case studies provide concrete examples of how assertions work as a safety net, catching vulnerabilities that might slip through traditional security measures like audits and testing.
Each analysis includes:
Loss: $58M+ USD
Root Cause: Attackers gained control of multisig signers and changed ownership of lending pools
Prevention: Owner change assertions with proper validation and whitelisting
Loss: $1.4B USD
Root Cause: Compromised frontend showed fake transactions while changing proxy implementation
Prevention: Implementation address change assertions and transaction validation
Loss: $6.5M USD
Root Cause: Rounding error in RebaseToken mechanism allowed base value inflation
Prevention: Invariant checks ensuring debt shares consistency
Loss: $280K USD (limited by quick response)
Root Cause: One-letter bug (
Prevention: Maximum reward rate validation assertions
Loss: Protocol drained
Root Cause: Missing validation of
Prevention: State flag validation assertions
Loss: $130M USD
Root Cause: Sudden price manipulation through asset donation to vault
Prevention: Price deviation monitoring assertions
Loss: $7.5M USD
Root Cause: Lack of access controls in MinimalForwarder allowed price manipulation
Prevention: Price deviation assertions and access control validation
Loss: $42M USD
Root Cause: Reentrancy vulnerability allowed artificial AUM inflation
Prevention: AUM manipulation bounds assertions and atomic state consistency
Loss: $197M USD
Root Cause: Donation function lacked health factor validation
Prevention: Health factor assertions after all state changes
Loss: Various protocols affected
Root Cause: First depositor can manipulate exchange rate through donation
Prevention: Minimum supply assertions and exchange rate validation
Loss: Protocol funds
Root Cause: Anyone could mint reward tokens without proper validation
Prevention: Collateralization ratio assertions
- Detailed explanation of the attack mechanism
- Root cause analysis of the vulnerability
- Specific assertion code that would have prevented the exploit
Access Control & Administrative Vulnerabilities
Radiant Capital Hack
Attack Type: Ownership TakeoverLoss: $58M+ USD
Root Cause: Attackers gained control of multisig signers and changed ownership of lending pools
Prevention: Owner change assertions with proper validation and whitelisting
Bybit - Compromised Safe Wallet UI
Attack Type: UI Compromise + Implementation ChangeLoss: $1.4B USD
Root Cause: Compromised frontend showed fake transactions while changing proxy implementation
Prevention: Implementation address change assertions and transaction validation
Arithmetic & Calculation Errors
Abracadabra Rounding Error Attack
Attack Type: Rounding Error ExploitationLoss: $6.5M USD
Root Cause: Rounding error in RebaseToken mechanism allowed base value inflation
Prevention: Invariant checks ensuring debt shares consistency
Compound Upgrade Bug
Attack Type: Logic Error in UpgradeLoss: $280K USD (limited by quick response)
Root Cause: One-letter bug (
> instead of >=) in reward calculationPrevention: Maximum reward rate validation assertions
Vestra DAO Hack
Attack Type: Unchecked State FlagLoss: Protocol drained
Root Cause: Missing validation of
isActive flag in unstake functionPrevention: State flag validation assertions
Oracle & Price Manipulation
Cream Finance 2
Attack Type: Price ManipulationLoss: $130M USD
Root Cause: Sudden price manipulation through asset donation to vault
Prevention: Price deviation monitoring assertions
KiloEx Price Oracle Manipulation
Attack Type: Access Control + Price ManipulationLoss: $7.5M USD
Root Cause: Lack of access controls in MinimalForwarder allowed price manipulation
Prevention: Price deviation assertions and access control validation
GMX v1 AUM Manipulation Hack
Attack Type: Reentrancy + AUM ManipulationLoss: $42M USD
Root Cause: Reentrancy vulnerability allowed artificial AUM inflation
Prevention: AUM manipulation bounds assertions and atomic state consistency
Protocol Logic Vulnerabilities
Euler Finance Donation Hack
Attack Type: Missing Health CheckLoss: $197M USD
Root Cause: Donation function lacked health factor validation
Prevention: Health factor assertions after all state changes
First Depositor Bug
Attack Type: Share Price ManipulationLoss: Various protocols affected
Root Cause: First depositor can manipulate exchange rate through donation
Prevention: Minimum supply assertions and exchange rate validation
Visor Finance Unrestricted Mint
Attack Type: Unrestricted Token MintingLoss: Protocol funds
Root Cause: Anyone could mint reward tokens without proper validation
Prevention: Collateralization ratio assertions