Hack Case Studies

Use this section when you want to understand why a real exploit worked and which assertion pattern would have blocked it. If you already know the kind of invariant you want and just need examples, use the assertion pattern catalog. These pages analyze real-world hacks and demonstrate how assertions could have prevented them. They show how assertions work as a safety net by catching failures that might slip through audits and testing. Each analysis includes:

• Detailed explanation of the attack mechanism
• Root cause analysis of the vulnerability
• Specific assertion patterns, and code examples where they have been implemented and tested

​

Cross-Chain, Runtime, and Operational Risk

Recent incidents show that protocol risk often comes from external dependencies, bridge configuration, operational controls, and asset-flow assumptions rather than only from a bug in the protected contract itself. Runtime assertions are useful in these cases because they can enforce outcome-based limits around what state should never be reached.

​

KelpDAO / rsETH LayerZero Configuration Incident

Attack Type: Cross-chain Configuration + Message Verification Failure Loss: Reported $290M USD Root Cause: Reported compromise or misuse of cross-chain verification infrastructure, with public dispute over whether KelpDAO’s rsETH LayerZero configuration was the direct cause Prevention: Cross-chain inflow circuit breakers, backing/supply parity assertions, and message-security configuration assertions

​

Drift Admin Takeover

Attack Type: Operational Security + Administrative Takeover Loss: Reported $280M+ USD Root Cause: Reported misrepresented approvals and durable nonce abuse enabled takeover of emergency administrative powers Prevention: Admin role-graph assertions, high-impact action allowlists, and protocol outflow circuit breakers

​

Access Control & Administrative Vulnerabilities

​

Bybit - Compromised Safe Wallet UI

Attack Type: UI Compromise + Implementation Change Loss: $1.4B USD Root Cause: Compromised frontend showed fake transactions while changing proxy implementation Prevention: Implementation address change assertions and transaction validation

​

Radiant Capital Hack

Attack Type: Ownership Takeover Loss: $58M+ USD Root Cause: Attackers gained control of multisig signers and changed ownership of lending pools Prevention: Owner change assertions with proper validation and whitelisting

​

UxLink Multisig Ownership Compromise

Attack Type: Private Key Compromise + Multisig Manipulation Loss: $39.3M USD Root Cause: Compromised private keys enabled rapid multisig reconfiguration and threshold reduction Prevention: Threshold protection assertions, owner whitelisting, and cooling periods

​

Arithmetic & Calculation Errors

​

Balancer V2 Rate Manipulation Exploit

Attack Type: Rounding Error Accumulation Loss: $120M+ USD Root Cause: Accumulated rounding errors in stable pool invariant calculation manipulated exchange rates Prevention: Rate change bounds assertions detecting drastic pool rate changes within single transactions

​

Bunni XYZ Rounding Error Exploit

Attack Type: Rounding Error + Liquidity Manipulation Loss: $8.4M USD Root Cause: Rounding error in withdrawal mechanism led to disproportionate liquidity decreases Prevention: Withdrawal proportionality assertions ensuring balance decreases match share burns

​

Abracadabra Rounding Error Attack

Attack Type: Rounding Error Exploitation Loss: $6.5M USD Root Cause: Rounding error in RebaseToken mechanism allowed base value inflation Prevention: Invariant checks ensuring debt shares consistency

​

Vestra DAO Hack

Attack Type: Unchecked State Flag Loss: Protocol drained Root Cause: Missing validation of isActive flag in unstake function Prevention: State flag validation assertions

​

Compound Upgrade Bug

Attack Type: Logic Error in Upgrade Loss: $280K USD (limited by quick response) Root Cause: One-letter bug (> instead of >=) in reward calculation Prevention: Maximum reward rate validation assertions

​

Oracle & Price Manipulation

​

GMX v1 AUM Manipulation Hack

Attack Type: Reentrancy + AUM Manipulation Loss: $42M USD Root Cause: Reentrancy vulnerability allowed artificial AUM inflation Prevention: AUM manipulation bounds assertions and atomic state consistency

​

KiloEx Price Oracle Manipulation

Attack Type: Access Control + Price Manipulation Loss: $7.5M USD Root Cause: Lack of access controls in MinimalForwarder allowed price manipulation Prevention: Price deviation assertions and access control validation

​

Vicuna Finance Oracle Manipulation

Attack Type: LP Token Oracle Manipulation Loss: $700K USD Root Cause: LP tokens priced using simple sum formula instead of fair pricing Prevention: Price deviation assertions monitoring oracle changes per call

​

Cream Finance 2

Attack Type: Price Manipulation Loss: $130M USD Root Cause: Sudden price manipulation through asset donation to vault Prevention: Price deviation monitoring assertions

​

Protocol Logic Vulnerabilities

​

Abracadabra GMX V2 Cauldron Exploit

Attack Type: Accounting Bug Loss: $13.4M USD Root Cause: Phantom collateral created when tokens extracted without updating order value Prevention: Collateral tracking assertions ensuring borrowed amounts never exceed actual collateral

​

Abracadabra CauldronV4 Cook Function Exploit

Attack Type: Logic Flaw in Action Sequencing Loss: $1.8M USD Root Cause: Action sequence [5, 0] allowed solvency check flag to be set then immediately cleared Prevention: Post-transaction solvency assertions enforcing outcome-based validation

​

Euler Finance Donation Hack

Attack Type: Missing Health Check Loss: $197M USD Root Cause: Donation function lacked health factor validation Prevention: Health factor assertions after all state changes

​

Visor Finance Unrestricted Mint

Attack Type: Unrestricted Token Minting Loss: Protocol funds Root Cause: Anyone could mint reward tokens without proper validation Prevention: Collateralization ratio assertions

​

First Depositor Bug

Attack Type: Share Price Manipulation Loss: Various protocols affected Root Cause: First depositor can manipulate exchange rate through donation Prevention: Minimum supply assertions and exchange rate validation