defirisk.co
rubric v1.7.0

Audit count

A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.

Methodology how we score #

What this measures
This factor records the count of distinct, independent audit firms whose reports cover any portion of the currently deployed bytecode. Each firm is counted once regardless of how many reports they have issued. The data source is publicly available audit PDFs, and the count is restricted to firms that reviewed code currently live on-chain -- audits of deprecated or superseded contracts do not count toward the current total.

Why it matters
A single audit is a single opinion. Multiple independent auditors reviewing the same code have historically caught bugs that one firm missed: MonoX ($31.4M, 2021) was reviewed by both Halborn and PeckShield, yet both missed the self-swap token pricing bug. While multiple audits do not guarantee safety, a protocol with zero audits removes even the baseline gatekeeping. Unaudited protocols account for a disproportionate share of exploits in the dataset -- including Cetus ($223M, 2025), where the integer-mate library exploited was explicitly excluded from all audit scopes. Audit count serves as a floor signal for the minimum diligence applied to a protocol's code.

Green / Yellow / Red
Green: two or more independent audit firms have reviewed the currently deployed code, covering the primary contracts holding user funds. Yellow: exactly one audit exists covering the deployed code, with no independent second opinion. Red: no audit by any firm covers the currently deployed code, including the primary contracts holding user funds.

Common gray cases
Curators cannot grade this factor when audit PDFs are not publicly available and the protocol cannot confirm audit provenance, or when the protocol claims private audits but refuses to disclose them.

Notable historical examples
- Compound Finance ($147M, 2021): Exploited code in the Proposal 62 upgrade was unaudited regardless of the protocol's overall audit history.
- Cetus Protocol ($223M, 2025): The integer-mate library was explicitly out of scope for all audits; audit count = 0 for the exploited surface.
- Nomad Bridge ($190M, 2022): The specific initialisation parameter vulnerability was in an unaudited upgrade.
- BNB Bridge ($586M, 2022): The exploited flaw was in code without specific audit coverage.
- Fei/Rari Fuse ($80M, 2022): Vulnerability was in code modified after the last audit.

Measurement what to look for #

Count the number of distinct audit firms whose reports cover any portion of the currently-deployed bytecode.

Data & output #

Data source
Auditor firm report index pages + protocol docs security section + GitHub repo (audits/ directory)
Output format
Green / Yellow / Red
Evidence artifact
List of audit firm slugs + report PDF URLs + SHA-256 per PDF
Confidence signal
green = ≥2 distinct firms; yellow = 1 firm; red = 0 audits; gray = no verifiable audit record found

Scored protocols 0 carry this factor #

No protocols have been scored for this factor yet.

Linked hacks 107 historical incidents #

causal Kelp DAO (rsETH liquid restaking) — Forged cross-chain message via LayerZero EndpointV2 lzReceive — exploitation of 1/1 DVN (single-validator) configuration 2026-04-18 · $292M · Forged cross-chain message via LayerZero EndpointV2 lzReceive — exploitation of 1/1 DVN (single-validator) configuration · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Likely unaudited or out-of-scope code (bridge contracts excluded from bug bounty; audit coverage of lzReceive configuration unconfirmed)]
causal Dango (custom-L1 perpetual DEX; Grug engine on Tendermint) — Missing sign/positivity check on `donate()` input in the insurance-fund contract — negative value reversed accounting direction 2026-04-13 · $2M · Missing sign/positivity check on `donate()` input in the insurance-fund contract — negative value reversed accounting direction · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Presumed unaudited (no public audit on record)]
causal Solv Protocol (BRO vault) — ERC-3525 Callback Reentrancy — Double Mint (onERC721Received fires before state update) 2026-03-05 · $3M · ERC-3525 Callback Reentrancy — Double Mint (onERC721Received fires before state update) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code (BRO vault never in any audit scope)]
causal Moonwell — Oracle Misconfiguration (Missing ETH/USD Multiplier) 2026-02-15 · $2M · Oracle Misconfiguration (Missing ETH/USD Multiplier) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited configuration (governance parameter)]
causal Truebit — Integer Overflow in Unverified Bytecode / Bonding Curve Exploit 2026-01-08 · $26M · Integer Overflow in Unverified Bytecode / Bonding Curve Exploit · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal TMXTribe — Logic Bug — Mint/Stake/Swap Loop 2026-01-05 · $1M · Logic Bug — Mint/Stake/Swap Loop · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal GANA Payment — Leaked Owner Key + EIP-7702 Delegator Contract (onlyEOA Bypass) 2025-11-20 · $3M · Leaked Owner Key + EIP-7702 Delegator Contract (onlyEOA Bypass) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — no audit; off-chain key compromise as root cause]
causal Abracadabra Money (3rd incident — abracadabra-rekt3) — Deprecated cauldron security flag bypass — cook() action ordering resets solvency check flag → uncollateralized MIM borrow 2025-10-04 · $2M · Deprecated cauldron security flag bypass — cook() action ordering resets solvency check flag → uncollateralized MIM borrow · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited state — deprecated contracts with no audit since Nov 2023]
causal New Gold Protocol (NGP) — Flash loan + spot price oracle manipulation + broken transfer logic (dead address bypass of buy limits) 2025-09-17 · $2M · Flash loan + spot price oracle manipulation + broken transfer logic (dead address bypass of buy limits) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — two independent elementary vulnerabilities]
causal AlexLab (Bitcoin DeFi / Stacks) — Vault permission hijack via malicious token self-listing; `as-contract` context abuse 2025-06-06 · $16M · Vault permission hijack via malicious token self-listing; `as-contract` context abuse · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code** — exploited contract was not in audit scope]
causal Cork Protocol — Fake token injection → exchange rate manipulation via unvalidated CorkHook input 2025-05-28 · $12M · Fake token injection → exchange rate manipulation via unvalidated CorkHook input · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code (CorkHook was out of scope for all known auditors)]
causal Cetus Protocol — Integer Overflow / Division-by-Near-Zero in Concentrated Liquidity Math 2025-05-22 · $223M · Integer Overflow / Division-by-Near-Zero in Concentrated Liquidity Math · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited** — Zellic explicitly stated the `integer-mate` library was out of scope for their April 2025 audit. MoveIT and Otter audited 2 ye...]
causal MobiusDAO — Decimal handling double-multiplication bug in minting function — pennies-to-quadrillions inflation 2025-05-11 · $2M · Decimal handling double-multiplication bug in minting function — pennies-to-quadrillions inflation · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — elementary double-multiplication bug]
causal LNDFi (LND.fi) — Admin Backdoor (Malicious Code Injection by Contractor / DPRK Dev) 2025-05-09 · $1M · Admin Backdoor (Malicious Code Injection by Contractor / DPRK Dev) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited; backdoor injected at development stage]
causal KiloEx — Missing signature verification in MinimalForwarder → unvalidated oracle price update → multi-chain drain 2025-04-14 · $7M · Missing signature verification in MinimalForwarder → unvalidated oracle price update → multi-chain drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code (out of scope for all 5 audits)]
causal The Idols NFT — Self-Transfer Reward Loop (Logic Bug in Token Transfer Hook) 2025-01-14 · $324K · Self-Transfer Reward Loop (Logic Bug in Token Transfer Hook) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Audited (if Tikkala Security did audit) or unaudited (if they were only the detector) — unclear]
causal Orange Finance — Admin private key compromise → proxy upgrade → privileged drain of LP vault positions 2025-01-07 · $844K · Admin private key compromise → proxy upgrade → privileged drain of LP vault positions · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Clober DEX — Reentrancy (Post-Audit Code Change) 2024-12-10 · $500K · Reentrancy (Post-Audit Code Change) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (post-audit addition)]
causal Polter Finance — Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow 2024-11-16 · $9M · Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Bedrock (uniBTC vault) — Unregistered NATIVE_BTC in SigmaSupplier → disabled supply cap → ETH-to-BTC 1:1 minting (infinite mint) 2024-09-25 · $2M · Unregistered NATIVE_BTC in SigmaSupplier → disabled supply cap → ETH-to-BTC 1:1 minting (infinite mint) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited post-upgrade code]
causal Griffin AI ($GAIN token) — Fake LayerZero Peer Initialization (Cross-Chain Minting Exploit) 2024-09-24 · $3M · Fake LayerZero Peer Initialization (Cross-Chain Minting Exploit) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited; LayerZero OFT peer configuration misconfiguration]
causal Banana Gun — Telegram Message Oracle Vulnerability 2024-09-19 · $3M · Telegram Message Oracle Vulnerability · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (off-chain component)]
causal Penpie — Reentrancy via fake Pendle market → staking balance inflation → excess reward drain 2024-09-03 · $27M · Reentrancy via fake Pendle market → staking balance inflation → excess reward drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (post-audit feature addition)]
causal Astroport (on Terra Phoenix chain) — IBC hooks reentrancy — reintroduced known vulnerability in June upgrade after April patch; timeout callback re-enters token minting 2024-07-30 · $6M · IBC hooks reentrancy — reintroduced known vulnerability in June upgrade after April patch; timeout callback re-enters token minting · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Chain infrastructure (unaudited per-upgrade)]
causal LiFi Protocol (Jumper Exchange) — Call Injection via Unvalidated Swap Function 2024-07-16 · $10M · Call Injection via Unvalidated Swap Function · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited new code]
causal Pike Finance — Storage Layout Collision → Unauthorized Proxy Upgrade / Ownership Takeover 2024-04-26 · $2M · Storage Layout Collision → Unauthorized Proxy Upgrade / Ownership Takeover · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (emergency patch)]
causal Hedgey Finance — Unverified User Input — Flash Loan Enabled Approval Manipulation 2024-04-19 · $45M · Unverified User Input — Flash Loan Enabled Approval Manipulation · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (post-audit code addition)]
causal Grand Base — Deployer wallet private key leak → unauthorized token minting → dump 2024-04-15 · $2M · Deployer wallet private key leak → unauthorized token minting → dump · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code; root cause is key management failure not a code bug]
causal PrismaFi — Flash Loan + Missing Input Validation (Migration Helper) 2024-03-28 · $12M · Flash Loan + Missing Input Validation (Migration Helper) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (newly deployed migration helper)]
causal Munchables — Malicious Insider — Storage Slot Manipulation via Upgradeable Proxy 2024-03-26 · $63M · Malicious Insider — Storage Slot Manipulation via Upgradeable Proxy · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (unverified implementation)]
causal Unizen — Unvalidated external call in upgraded DEX Aggregation contract — approval drain 2024-03-08 · $2M · Unvalidated external call in upgraded DEX Aggregation contract — approval drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code (the upgrade)]
causal Socket (Bungee Bridge) — Unvalidated user input in new route — transferFrom injection via approval drain 2024-01-16 · $3M · Unvalidated user input in new route — transferFrom injection via approval drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — post-audit route addition]
causal Yearn Finance (legacy iearn TUSD V1 vault — deployed 2020) — Flash loan → misconfigured vault (TUSD vault tracking iSUSD/sUSD strategy) → share accounting inflation → Curve yPool drain 2023-12-16 · $293K · Flash loan → misconfigured vault (TUSD vault tracking iSUSD/sUSD strategy) → share accounting inflation → Curve yPool drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited at time of exploit; legacy configuration error never caught]
causal Yearn Finance (yETH LST stableswap pool + yETH-WETH Curve pool) — Invariant corruption via remove_liquidity(0) + update_rates() calls → Newton-Raphson arithmetic underflow → 235 trillion yETH minted from dust deposit → single-asset drain 2023-11-30 · $9M · Invariant corruption via remove_liquidity(0) + update_rates() calls → Newton-Raphson arithmetic underflow → 235 trillion yETH minted from dust deposit → single-asset drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited-at-time-of-exploit (audits were historical; no ongoing review of this abandoned pool)]
causal Anonymous MEV Sandwich Bot (on-chain MEV contract) — Unprotected public swap function → sandwich attack via Curve WETH/WBTC pool — $50M flash loan 2023-11-07 · $2M · Unprotected public swap function → sandwich attack via Curve WETH/WBTC pool — $50M flash loan · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — proprietary bot contract]
causal Unibot — Unvalidated arbitrary call in new router — transferFrom injection via approval drain 2023-10-31 · $640K · Unvalidated arbitrary call in new router — transferFrom injection via approval drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code]
causal Platypus Finance (3rd exploit) — Flash loan + LP-AVAX pool cash/liability manipulation → slippage-inflated swap output 2023-10-12 · $2M · Flash loan + LP-AVAX pool cash/liability manipulation → slippage-inflated swap output · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (post-audit deployment)]
causal Stars Arena — Reentrancy 2023-10-07 · $3M · Reentrancy · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Exactly Protocol — Unvalidated market address in periphery — fake market injection → _msgSender hijack → collateral drain + reentrancy 2023-08-18 · $7M · Unvalidated market address in periphery — fake market injection → _msgSender hijack → collateral drain + reentrancy · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited periphery code]
causal RocketSwap — Bruteforced server private keys → farming contract drain via proxy admin + high-risk permissions 2023-08-14 · $869K · Bruteforced server private keys → farming contract drain via proxy admin + high-risk permissions · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — root cause is key management and proxy permission architecture]
causal Zunami Protocol — Flash loan + SDT token swap → totalHoldings price calculation manipulation → zETH/UZD LP price manipulation → drain 2023-08-13 · $2M · Flash loan + SDT token swap → totalHoldings price calculation manipulation → zETH/UZD LP price manipulation → drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (post-audit strategy addition)]
causal DeFiLabs — Backdoor Function in Staking Contract (Insider Rug Pull) 2023-07-27 · $2M · Backdoor Function in Staking Contract (Insider Rug Pull) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — vPoolv6 not in audit scope]
causal EraLend (formerly Nexon Finance) — Read-Only Reentrancy (SyncSwap LP Callback — Stale Reserves Oracle) 2023-07-25 · $3M · Read-Only Reentrancy (SyncSwap LP Callback — Stale Reserves Oracle) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Effectively unaudited — oracle mechanism explicitly excluded from audit scope]
causal Conic Finance — Read-only reentrancy in CurveLPOracleV2 (ETH/WETH mismatch bypassed reentrancy guard) + sandwich attack on imbalanced pool 2023-07-21 · $4M · Read-only reentrancy in CurveLPOracleV2 (ETH/WETH mismatch bypassed reentrancy guard) + sandwich attack on imbalanced pool · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (new contract out of scope); audit had flagged the same class of bug in a different contract]
causal Jimbo's Protocol — Flash loan + missing slippage control in rebalancing function → liquidity drain 2023-05-28 · $8M · Flash loan + missing slippage control in rebalancing function → liquidity drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — no audit existed]
causal Swaprum — Rug Pull via Malicious Contract Upgrade 2023-05-18 · $3M · Rug Pull via Malicious Contract Upgrade · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (malicious upgrade); structural risk in audited (upgradeable contract owned by team)]
causal Deus DAO / DEI stablecoin — Mis-ordered Parameters in burnFrom — Public Approval Override 2023-05-06 · $7M · Mis-ordered Parameters in burnFrom — Public Approval Override · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unknown — likely unaudited for the specific upgrade]
causal Yearn Finance (iearn yUSDT) — Misconfiguration (copy/paste error) in yUSDT — wrong Fulcrum USDC address used instead of USDT → share price manipulation → 1.2 quadrillion yUSDT minted 2023-04-13 · $10M · Misconfiguration (copy/paste error) in yUSDT — wrong Fulcrum USDC address used instead of USDT → share price manipulation → 1.2 quadrillion yUSDT minted · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (yUSDT specifically) — copy/paste error at deployment]
causal Safemoon — Upgrade introduced public burn() function → LP token burn → pool price manipulation → BNB drain 2023-03-28 · $9M · Upgrade introduced public burn() function → LP token burn → pool price manipulation → BNB drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — the upgrade was not reviewed]
causal Kokomo Finance — Insider rug — deployer upgraded implementation to malicious contract → drained WBTC deposits 2023-03-26 · $4M · Insider rug — deployer upgraded implementation to malicious contract → drained WBTC deposits · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited lending contracts]
causal Dexible — Unvalidated router — selfSwap() transferFrom injection via approval drain 2023-02-17 · $2M · Unvalidated router — selfSwap() transferFrom injection via approval drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code]
causal Platypus Finance — Flash loan + emergencyWithdraw() solvency check bypass — collateral withdrawal without repaying borrowed USP 2023-02-16 · $9M · Flash loan + emergencyWithdraw() solvency check bypass — collateral withdrawal without repaying borrowed USP · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Orion Protocol — Fake token reentrancy — depositAsset() double-credit via ATK token transfer hook 2023-02-02 · $3M · Fake token reentrancy — depositAsset() double-credit via ATK token transfer hook · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal BonqDAO — Oracle Manipulation (Tellor Price Feed — Instant Value) 2023-02-01 · $120M · Oracle Manipulation (Tellor Price Feed — Instant Value) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (post-audit oracle contracts)]
causal Midas Capital — Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation 2023-01-15 · $660K · Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited new collateral integration; the read-only reentrancy risk was known from market.xyz (Oct 2022)]
causal Lodestar Finance — Oracle Price Manipulation (LP Token Donation) 2022-12-10 · $7M · Oracle Price Manipulation (LP Token Donation) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Likely unaudited custom oracle code]
causal Skyward Finance — Missing Parameter Validation — Redemption Loop (redeem_skyward) 2022-11-03 · $3M · Missing Parameter Validation — Redemption Loop (redeem_skyward) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unknown (likely unaudited)]
causal TempleDAO / STAX Finance — Missing access control in migrateStake() — unvalidated oldStaking parameter 2022-10-11 · $2M · Missing access control in migrateStake() — unvalidated oldStaking parameter · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code (STAX staking contract)]
causal BNB Bridge / BSC Token Hub — Forged Cryptographic Proof / IAVL Verification Bypass 2022-10-06 · $586M · Forged Cryptographic Proof / IAVL Verification Bypass · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited for this specific flaw]
causal Sovryn — External call reentrancy via callTokensToSend — token price inflation via mid-transaction mint → overclaim via burn 2022-10-04 · $1M · External call reentrancy via callTokensToSend — token price inflation via mid-transaction mint → overclaim via burn · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Transit Swap — Controllable transferFrom() in unverified (closed-source) swap contract — approval drain 2022-10-01 · $21M · Controllable transferFrom() in unverified (closed-source) swap contract — approval drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — contracts were not even verified on-chain]
causal 0xbad MEV Bot (on-chain MEV arbitrage contract) — Unprotected flashloan callback — arbitrary execution via callFunction → WETH approval exploit 2022-09-27 · $2M · Unprotected flashloan callback — arbitrary execution via callFunction → WETH approval exploit · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — proprietary bot contract]
causal Nomad Bridge — Initialisation Error — Zero-Address Trusted Root (Merkle Proof Bypass) 2022-08-02 · $190M · Initialisation Error — Zero-Address Trusted Root (Merkle Proof Bypass) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited upgrade (initialisation parameter)]
causal Nirvana Finance — Flash Loan + AMM Price Manipulation (Treasury Drain) 2022-07-28 · $4M · Flash Loan + AMM Price Manipulation (Treasury Drain) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unknown — likely unaudited given "automatic audit" claim]
causal Inverse Finance — Oracle Price Manipulation (Flash Loan) 2022-06-16 · $6M · Oracle Price Manipulation (Flash Loan) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Likely unaudited oracle addition]
causal Gym Network (GymNet) — Missing caller verification — fake deposits via unchecked balance inflation → withdraw drain 2022-06-10 · $2M · Missing caller verification — fake deposits via unchecked balance inflation → withdraw drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code (post-audit addition)]
causal Fei Protocol / Rari Capital (Fuse) — Re-entrancy via `exitMarket()` in Compound fork missing check-effects-interaction pattern 2022-04-30 · $80M · Re-entrancy via `exitMarket()` in Compound fork missing check-effects-interaction pattern · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited version of patched code; vulnerability re-introduced in a developer commit to forked Compound code]
causal Elephant Money — Flash loan + spot price manipulation during stablecoin minting 2022-04-12 · $22M · Flash loan + spot price manipulation during stablecoin minting · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Mixed: vulnerability identified in audit but unaddressed; drained treasury was unaudited]
causal Inverse Finance — SushiSwap TWAP Oracle Manipulation — Thin Liquidity Governance Token 2022-04-02 · $16M · SushiSwap TWAP Oracle Manipulation — Thin Liquidity Governance Token · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Voltage Finance / Ola Finance — ERC677 callAfterTransfer() reentrancy in Compound fork — borrow before balance update 2022-03-31 · $4M · ERC677 callAfterTransfer() reentrancy in Compound fork — borrow before balance update · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Likely unaudited for ERC677 compatibility; inherited Compound fork risk]
causal Cashio — Infinite mint via incomplete collateral validation — fake account chain bypasses all verification 2022-03-23 · $48M · Infinite mint via incomplete collateral validation — fake account chain bypasses all verification · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code]
causal Deus DAO (DEI lending contract) — Flash loan oracle manipulation via Solidly AMM pool → user position liquidation 2022-03-15 · $3M · Flash loan oracle manipulation via Solidly AMM pool → user position liquidation · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited newly deployed contract]
causal Deus DAO (1st incident) — Flash loan → spot price manipulation of Solidex USDC/DEI AMM pool (used as oracle) → user positions liquidated 2022-03-15 · $3M · Flash loan → spot price manipulation of Solidex USDC/DEI AMM pool (used as oracle) → user positions liquidated · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Meter (Passport Bridge) — Deposit method calldata bypass — unwrapped native token assumption not enforced in secondary deposit path 2022-02-05 · $8M · Deposit method calldata bypass — unwrapped native token assumption not enforced in secondary deposit path · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (the Meter-specific ERC20 Handler modification)]
causal Visor Finance — Vulnerable require() in vVISR deposit() — self-referential ownership bypass → unlimited share minting 2021-12-22 · $8M · Vulnerable require() in vVISR deposit() — self-referential ownership bypass → unlimited share minting · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code]
causal Grim Finance — Reentrancy 2021-12-18 · $30M · Reentrancy · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal BrincFi — Insider backdoor — rescueTokens() admin drain via ownership transfer + malicious contract upgrade 2021-12-14 · $1M · Insider backdoor — rescueTokens() admin drain via ownership transfer + malicious contract upgrade · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited; insider-introduced backdoor]
causal 8ight Finance — Admin key compromise — private key shared via Facebook chat and Google Drive → treasury drain 2021-12-07 · $2M · Admin key compromise — private key shared via Facebook chat and Google Drive → treasury drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Snowdog (SnowdogDAO) — Insider front-running — privileged challengeKey knowledge + custom AMM sniping 2021-11-25 · $21M · Insider front-running — privileged challengeKey knowledge + custom AMM sniping · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — custom Snowswap AMM with challengeKey]
causal Indexed Finance — Flash Loan — Rebalancing Delay Pool Oracle Manipulation 2021-10-14 · $16M · Flash Loan — Rebalancing Delay Pool Oracle Manipulation · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal DAO Maker — Reinitializable init() function + emergencyExit() drain on token vesting contracts 2021-09-04 · $4M · Reinitializable init() function + emergencyExit() drain on token vesting contracts · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Disputed; likely unaudited or audit scope did not cover the specific vesting contracts]
causal Cream Finance — ERC-777 Reentrancy (Token Integration Vulnerability) 2021-08-30 · $19M · ERC-777 Reentrancy (Token Integration Vulnerability) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — the AMP token integration (ERC-777 callback) was added post-audit]
causal Punk Protocol — Unprotected initialize() — delegateCall Forge Address Override 2021-08-10 · $9M · Unprotected initialize() — delegateCall Forge Address Override · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unknown (likely unaudited — no audit mentioned)]
causal Popsicle Finance (Sorbetto Fragola) — Fee Accounting Bug — LP Token Transfer Without Reward Checkpoint 2021-08-04 · $20M · Fee Accounting Bug — LP Token Transfer Without Reward Checkpoint · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unknown — likely unaudited or audit missed known bug class]
causal THORChain — Fake deposit via fake Asgard vault + malicious memo — Bifrost refund logic abuse 2021-07-26 · $8M · Fake deposit via fake Asgard vault + malicious memo — Bifrost refund logic abuse · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code]
causal THORChain — ETH Bifrost override loop — msg.value spoofing via wrapped router 2021-07-16 · $5M · ETH Bifrost override loop — msg.value spoofing via wrapped router · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code (ETH MCCN Bifrost)]
causal ChainSwap — Auth bypass in Factory minting contract — sloppy signature check bypassed with fresh addresses 2021-07-11 · $4M · Auth bypass in Factory minting contract — sloppy signature check bypassed with fresh addresses · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited / inadequate review]
causal AnySwap (Multichain) V3 — ECDSA repeated k-value (same R signature) → MPC private key back-calculation 2021-07-10 · $8M · ECDSA repeated k-value (same R signature) → MPC private key back-calculation · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (V3); off-chain MPCNode software]
causal Merlin Labs (REKT 3) — Reward Minting Manipulation (Balance Inflation) 2021-06-29 · $330K · Reward Minting Manipulation (Balance Inflation) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (new test vault)]
causal SafeDollar — Infinite Mint via Fee-on-Transfer Reward Accounting Bug 2021-06-28 · $248K · Infinite Mint via Fee-on-Transfer Reward Accounting Bug · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal StableMagnet — Malicious Unverified Library (SwapUtils) — Rugpull with Approval Drain 2021-06-24 · $27M · Malicious Unverified Library (SwapUtils) — Rugpull with Approval Drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (deployed library differed from audited source)]
causal Alchemix — Logic bug in alETH collateral accounting — ETH collateral position assigned zero debt → users could withdraw collateral without repaying loan 2021-06-16 · $5 · Logic bug in alETH collateral accounting — ETH collateral position assigned zero debt → users could withdraw collateral without repaying loan · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: New feature code — likely unaudited or insufficiently reviewed]
causal Eleven Finance (11) — emergencyBurn() missing balance accounting — ghost withdrawal double-spend 2021-06-14 · $5M · emergencyBurn() missing balance accounting — ghost withdrawal double-spend · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal AutoShark Finance — Flash loan + SharkMinter balance spoofing → excess native token minting 2021-06-01 · $745K · Flash loan + SharkMinter balance spoofing → excess native token minting · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Levyathan Finance — Exposed Private Key + Minting + emergencyWithdraw Bug 2021-06-01 · $2M · Exposed Private Key + Minting + emergencyWithdraw Bug · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal BurgerSwap — Reentrancy via non-standard BEP-20 + missing x*y=k invariant check 2021-05-28 · $7M · Reentrancy via non-standard BEP-20 + missing x*y=k invariant check · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Merlin Labs (REKT 2) — Oracle Mispricing 2021-05-27 · $550K · Oracle Mispricing · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (post-hack patch)]
causal PancakeBunny — Flash loan + spot price manipulation → inflated LP token valuation → excess BUNNY minting 2021-05-19 · $45M · Flash loan + spot price manipulation → inflated LP token valuation → excess BUNNY minting · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — the exploited vault code was a post-audit upgrade]
causal bEarnFi (BvaultsBank) — Logic bug — token denomination mismatch between vault and strategy layers 2021-05-16 · $18M · Logic bug — token denomination mismatch between vault and strategy layers · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited code]
causal Uranium Finance — Math bug — constant product formula check broken by inconsistent parameter change (1000→10000) 2021-04-28 · $57M · Math bug — constant product formula check broken by inconsistent parameter change (1000→10000) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — no audit performed]
causal Cover Protocol (formerly SAFE / SAFE2) — Infinite Mint — Blacksmith Farming Contract Withdrawal Bug 2020-12-28 · $9M · Infinite Mint — Blacksmith Farming Contract Withdrawal Bug · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Appears unaudited or newly deployed code path]
causal Warp Finance — Flash loan + Uniswap V2 LP token spot oracle manipulation → inflated collateral → over-borrow drain 2020-12-17 · $8M · Flash loan + Uniswap V2 LP token spot oracle manipulation → inflated collateral → over-borrow drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Compounder Finance — Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull) 2020-12-02 · $12M · Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — the malicious strategies were added after audit completion]
causal Pickle Finance — Fake jar injection — missing whitelist in Controller's jar-swap function 2020-11-22 · $20M · Fake jar injection — missing whitelist in Controller's jar-swap function · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited — `controller-v4.sol` was not in scope of either audit]
causal Value DeFi — Flash loan + Curve spot price oracle manipulation → inflated collateral → over-borrow drain 2020-11-14 · $7M · Flash loan + Curve spot price oracle manipulation → inflated collateral → over-borrow drain · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited]
causal Cheese Bank — Flash loan + Uniswap LP spot oracle manipulation → inflated collateral value → drain via borrow() 2020-11-06 · $3M · Flash loan + Uniswap LP spot oracle manipulation → inflated collateral value → drain via borrow() · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited (likely)]
causal Eminence Finance (EMN) — Flash loan + bonding curve arbitrage (buy/burn/sell cycle) 2020-09-28 · $15M · Flash loan + bonding curve arbitrage (buy/burn/sell cycle) · Audit count likely 0; floor display [via dashboard_risk_factors/Vulnerability in audited or unaudited code: Unaudited; vulnerability is inherent to the bonding curve design (circular token mechanics exploitable via flash loans)]
rubric_version v1.7.0 factor RD-F-004 category 1 carried 0 critical no