defirisk.co
rubric v1.7.0

Bug bounty presence & max payout

A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.

Methodology how we score #

What this measures
This factor records whether the protocol operates a public bug bounty program and, if so, the maximum payout in USD. The data source is Immunefi API, Sherlock, Code4rena, and the protocol's own documentation. The field captures two values: a boolean (program active / inactive) and the declared maximum payout amount. Both are displayed on the protocol page.

Why it matters
Bug bounty programs create an economic incentive for external security researchers to disclose vulnerabilities rather than exploit them. Approximately 27 of the hacked protocols in the dataset had no public bounty program at the time of exploit. The absence of a bounty removes one of the few mechanisms by which a pre-existing vulnerability can be surfaced before an attacker finds it. At the same time, a bounty does not prevent exploits -- Euler Finance operated a program and the bug was missed both by internal review and by the bounty community. The bounty maximum payout matters: a $1,000 cap on a $1B TVL protocol provides no meaningful incentive relative to the exploit upside.

Green / Yellow / Red
Green: active public bug bounty program with a maximum payout of at least $100,000 for critical smart contract vulnerabilities, covering the primary contracts holding user funds. Yellow: program exists but maximum payout is below $100,000, or the program covers only a subset of deployed contracts. Red: no public bug bounty program of any kind, or program is explicitly inactive.

Common gray cases
Curators cannot grade this factor when the protocol's bounty status cannot be confirmed from public sources and the protocol does not respond to curator queries. Some protocols operate private or invitation-only programs that are not assessable.

Notable historical examples
- Harmony Bridge ($100M, 2022): No confirmed bug bounty program; bridge multisig compromise proceeded without external researcher disclosure.
- Badger DAO ($120M, 2021): No bug bounty program contributed to the front-end compromise going unreported before the attack.
- Ronin Network ($624M, 2022): Bug bounty status was unknown; 9-validator private multisig was exploited without prior disclosure.
- Wormhole ($326M, 2022): No confirmed pre-exploit bounty program; team later offered a $10M whitehat bounty retroactively.
- Beanstalk ($181M, 2022): No confirmed bug bounty at time of flash-loan governance attack.

Measurement what to look for #

Check whether a public bug bounty program is active for this protocol and record the maximum payout in USD.

Data & output #

Data source
Immunefi API (`/bounties` endpoint) + Sherlock contest list + protocol docs security page
Output format
Green / Yellow / Red
Evidence artifact
Immunefi program URL or equivalent + max payout USD + program-active boolean + checked_at timestamp
Confidence signal
green = active program with max payout ≥$500K; yellow = active program with max payout $50K–$499K or program exists but scope unclear; red = no active bounty program; gray = no information found

Scored protocols 0 carry this factor #

No protocols have been scored for this factor yet.

Linked hacks 173 historical incidents #

related Rhea Finance (merged entity of Ref Finance DEX + Burrow Finance lending; launched February 2025) — Permissionless fake-token pool creation → spot-price oracle acceptance → margin-trading `min_amount_out` double-counting across sequential swaps 2026-04-16 · $18M · Permissionless fake-token pool creation → spot-price oracle acceptance → margin-trading `min_amount_out` double-counting across sequential swaps · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: [PENDING: no confirmed Immunefi program identified in sources]]
related Dango (custom-L1 perpetual DEX; Grug engine on Tendermint) — Missing sign/positivity check on `donate()` input in the insurance-fund contract — negative value reversed accounting direction 2026-04-13 · $2M · Missing sign/positivity check on `donate()` input in the insurance-fund contract — negative value reversed accounting direction · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Partial — no formal program disclosed pre-incident; a negotiated post-exploit bounty was paid to the white-hat (amount undisclosed)]
related Aethir (decentralized GPU compute / DePIN; ATH token bridge) — Access control — unprotected/misauthorized `transferOwnership()` on AethirOFTAdapter; either missing `onlyOwner` modifier or compromised single-EOA admin key 2026-04-09 · $400K · Access control — unprotected/misauthorized `transferOwnership()` on AethirOFTAdapter; either missing `onlyOwner` modifier or compromised single-EOA admin key · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: [PENDING: no confirmed Immunefi program for the bridge adapter]]
related Drift Protocol (Solana perpetual futures DEX) — Multi-month social engineering + Solana durable-nonce pre-signing + fake-collateral-token / attacker-controlled oracle 2026-04-01 · $285M · Multi-month social engineering + Solana durable-nonce pre-signing + fake-collateral-token / attacker-controlled oracle · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: [PENDING: no confirmed Immunefi or equivalent program found in sources]]
related Solv Protocol (BRO vault) — ERC-3525 Callback Reentrancy — Double Mint (onERC721Received fires before state update) 2026-03-05 · $3M · ERC-3525 Callback Reentrancy — Double Mint (onERC721Received fires before state update) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No — HackenProof programs excluded EVM contracts; only Web2 infrastructure and Solana covered]
related YieldBlox / Script3 (Blend V2 community-managed pool) — Illiquid collateral oracle manipulation — single USTRY/USDC trade pumped price 100x → inflated collateral → undercollateralized borrow drain 2026-02-22 · $11M · Illiquid collateral oracle manipulation — single USTRY/USDC trade pumped price 100x → inflated collateral → undercollateralized borrow drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related IoTeX (ioTube Bridge) — Private key compromise → malicious contract upgrade → TokenSafe drain + MinterPool abuse 2026-02-21 · $4M · Private key compromise → malicious contract upgrade → TokenSafe drain + MinterPool abuse · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Announced post-hack ($440K, 10% of stolen funds, 48h window — no response)]
related Moonwell — Oracle Misconfiguration (Missing ETH/USD Multiplier) 2026-02-15 · $2M · Oracle Misconfiguration (Missing ETH/USD Multiplier) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Saga (SagaEVM / Saga Dollar) — IBC Precompile Input Validation Bypass → Infinite Mint 2026-01-21 · $7M · IBC Precompile Input Validation Bypass → Infinite Mint · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Makina Finance — Permissionless share price oracle update (updateTotalAum) + flash loan Curve pool manipulation → share price inflation → LP drain 2026-01-20 · $4M · Permissionless share price oracle update (updateTotalAum) + flash loan Curve pool manipulation → share price inflation → LP drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None pre-exploit (10% offered post-hack)]
related Truebit — Integer Overflow in Unverified Bytecode / Bonding Curve Exploit 2026-01-08 · $26M · Integer Overflow in Unverified Bytecode / Bonding Curve Exploit · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No]
related TMXTribe — Logic Bug — Mint/Stake/Swap Loop 2026-01-05 · $1M · Logic Bug — Mint/Stake/Swap Loop · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No]
related USPD — CPIMP (Clandestine Proxy In the Middle of Proxy) — front-run proxy initialization, shadow admin installation, 78-day dormancy, then mint + drain 2025-12-04 · $1M · CPIMP (Clandestine Proxy In the Middle of Proxy) — front-run proxy initialization, shadow admin installation, 78-day dormancy, then mint + drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: 10% offered post-hack; no pre-hack bounty publicized]
related GANA Payment — Leaked Owner Key + EIP-7702 Delegator Contract (onlyEOA Bypass) 2025-11-20 · $3M · Leaked Owner Key + EIP-7702 Delegator Contract (onlyEOA Bypass) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related New Gold Protocol (NGP) — Flash loan + spot price oracle manipulation + broken transfer logic (dead address bypass of buy limits) 2025-09-17 · $2M · Flash loan + spot price oracle manipulation + broken transfer logic (dead address bypass of buy limits) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related SwissBorg (via Kiln staking partner) — Partner API compromise — withdrawal authority transfer via hidden staking instructions 2025-09-08 · $42M · Partner API compromise — withdrawal authority transfer via hidden staking instructions · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Odin.Fun — AMM Liquidity Manipulation (Governance Token Price Pump + Drain) 2025-08-12 · $7M · AMM Liquidity Manipulation (Governance Token Price Pump + Drain) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related ArcadiaFi — Arbitrary swapData call via trusted rebalancer contract — attacker exploited cooldown period from decoy pause to prevent emergency shutdown during drain 2025-07-14 · $4M · Arbitrary swapData call via trusted rebalancer contract — attacker exploited cooldown period from decoy pause to prevent emergency shutdown during drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related ResupplyFi — ERC4626 Donation Attack (Vault Inflation / Zero Exchange Rate) 2025-06-25 · $10M · ERC4626 Donation Attack (Vault Inflation / Zero Exchange Rate) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown — not mentioned in source]
related Force Bridge (Nervos Network) — Access control compromise — admin key leak → privileged unlock() drain across two chains 2025-06-01 · $4M · Access control compromise — admin key leak → privileged unlock() drain across two chains · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: N — none mentioned]
related Zunami Protocol — Admin key compromise → withdrawStuckToken() drain of LP collateral 2025-05-14 · $500K · Admin key compromise → withdrawStuckToken() drain of LP collateral · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related MobiusDAO — Decimal handling double-multiplication bug in minting function — pennies-to-quadrillions inflation 2025-05-11 · $2M · Decimal handling double-multiplication bug in minting function — pennies-to-quadrillions inflation · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related LNDFi (LND.fi) — Admin Backdoor (Malicious Code Injection by Contractor / DPRK Dev) 2025-05-09 · $1M · Admin Backdoor (Malicious Code Injection by Contractor / DPRK Dev) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related KiloEx — Missing signature verification in MinimalForwarder → unvalidated oracle price update → multi-chain drain 2025-04-14 · $7M · Missing signature verification in MinimalForwarder → unvalidated oracle price update → multi-chain drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None pre-exploit (10% offered post-hack)]
related Abracadabra Money — Logic bug — phantom collateral / post-liquidation state inconsistency 2025-03-25 · $13M · Logic bug — phantom collateral / post-liquidation state inconsistency · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown / not mentioned in report]
related Infini (Crypto Neobank) — Retained Admin Privileges — Rogue Developer Backdoor 2025-02-24 · $50M · Retained Admin Privileges — Rogue Developer Backdoor · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: N/A]
related The Idols NFT — Self-Transfer Reward Loop (Logic Bug in Token Transfer Hook) 2025-01-14 · $324K · Self-Transfer Reward Loop (Logic Bug in Token Transfer Hook) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Moby Trade — Private key compromise → proxy admin key stolen → vault ownership transfer → drain 2025-01-08 · $1M · Private key compromise → proxy admin key stolen → vault ownership transfer → drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Orange Finance — Admin private key compromise → proxy upgrade → privileged drain of LP vault positions 2025-01-07 · $844K · Admin private key compromise → proxy upgrade → privileged drain of LP vault positions · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related GemPad — Reentrancy — Missing Guards on collectFees / Withdrawal Function 2024-12-17 · $2M · Reentrancy — Missing Guards on collectFees / Withdrawal Function · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Polter Finance — Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow 2024-11-16 · $9M · Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No]
related Tapioca DAO — Social engineering → private key compromise → vesting contract ownership takeover + stablecoin infinite mint → TAP dump + USDO/USDC LP drain 2024-10-18 · $4M · Social engineering → private key compromise → vesting contract ownership takeover + stablecoin infinite mint → TAP dump + USDO/USDC LP drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Radiant Capital — Compromised multisig private keys → malicious contract upgrade → pool ownership transfer → drain 2024-10-16 · $53M · Compromised multisig private keys → malicious contract upgrade → pool ownership transfer → drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Onyx Protocol (2nd incident) — Compound V2 empty-market donation attack — VUSD governance-added market 2024-09-25 · $4M · Compound V2 empty-market donation attack — VUSD governance-added market · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown / not advertised publicly]
related Bedrock (uniBTC vault) — Unregistered NATIVE_BTC in SigmaSupplier → disabled supply cap → ETH-to-BTC 1:1 minting (infinite mint) 2024-09-25 · $2M · Unregistered NATIVE_BTC in SigmaSupplier → disabled supply cap → ETH-to-BTC 1:1 minting (infinite mint) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None active at time of exploit; Bedrock invited attacker to become white-hat post-hack]
related Griffin AI ($GAIN token) — Fake LayerZero Peer Initialization (Cross-Chain Minting Exploit) 2024-09-24 · $3M · Fake LayerZero Peer Initialization (Cross-Chain Minting Exploit) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None mentioned]
related Penpie — Reentrancy via fake Pendle market → staking balance inflation → excess reward drain 2024-09-03 · $27M · Reentrancy via fake Pendle market → staking balance inflation → excess reward drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Unnamed Crypto Whale (Maker DSProxy vault) — Phishing → EOA compromise → DSProxy ownership transfer → DAI vault drain 2024-08-20 · $55M · Phishing → EOA compromise → DSProxy ownership transfer → DAI vault drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: N/A (personal wallet / Maker DSProxy — no user-level bug bounty)]
related Ronin Network (Bridge) — Uninitialized Variable in Contract Upgrade (initializeV3 Skipped) 2024-08-06 · $12M · Uninitialized Variable in Contract Upgrade (initializeV3 Skipped) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related ETHTrustFund (ETF) — Insider Rug Pull — Deployer Drains Treasury Smart Contract 2024-07-21 · $2M · Insider Rug Pull — Deployer Drains Treasury Smart Contract · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related Rho Market — Oracle misconfiguration (deployment error) → MEV bot price manipulation → USDC/USDT drain 2024-07-19 · Oracle misconfiguration (deployment error) → MEV bot price manipulation → USDC/USDT drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related LiFi Protocol (Jumper Exchange) — Call Injection via Unvalidated Swap Function 2024-07-16 · $10M · Call Injection via Unvalidated Swap Function · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Velocore — Fee Multiplier Manipulation + Underflow → Liquidity Token Mint 2024-06-02 · $7M · Fee Multiplier Manipulation + Underflow → Liquidity Token Mint · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Yes — 10% bug bounty offered post-hack (no pre-hack bounty mentioned)]
related Gala Games (GALA token contract) — Compromised Admin Account — Unauthorized Token Minting 2024-05-21 · $22M · Compromised Admin Account — Unauthorized Token Minting · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Pike Finance — Storage Layout Collision → Unauthorized Proxy Upgrade / Ownership Takeover 2024-04-26 · $2M · Storage Layout Collision → Unauthorized Proxy Upgrade / Ownership Takeover · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Hedgey Finance — Unverified User Input — Flash Loan Enabled Approval Manipulation 2024-04-19 · $45M · Unverified User Input — Flash Loan Enabled Approval Manipulation · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related PrismaFi — Flash Loan + Missing Input Validation (Migration Helper) 2024-03-28 · $12M · Flash Loan + Missing Input Validation (Migration Helper) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown — not mentioned in source]
related Munchables — Malicious Insider — Storage Slot Manipulation via Upgradeable Proxy 2024-03-26 · $63M · Malicious Insider — Storage Slot Manipulation via Upgradeable Proxy · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Curio (CurioDAO) — Voting power privilege escalation via MakerDAO fork governance bug → mass CGT token minting 2024-03-23 · $16M · Voting power privilege escalation via MakerDAO fork governance bug → mass CGT token minting · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program]
related Unizen — Unvalidated external call in upgraded DEX Aggregation contract — approval drain 2024-03-08 · $2M · Unvalidated external call in upgraded DEX Aggregation contract — approval drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Seneca Protocol — Approval Exploit — Arbitrary transferFrom via Constructed Calldata 2024-02-28 · $6M · Approval Exploit — Arbitrary transferFrom via Constructed Calldata · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: N — no bug bounty program]
related Ionic Money (formerly Midas) — Fake Collateral Listing (Social Engineering → On-chain Exploit) 2024-02-04 · $7M · Fake Collateral Listing (Social Engineering → On-chain Exploit) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Socket (Bungee Bridge) — Unvalidated user input in new route — transferFrom injection via approval drain 2024-01-16 · $3M · Unvalidated user input in new route — transferFrom injection via approval drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Gamma Strategies — Flash Loan — LP Token Price Manipulation (Price Threshold Bypass) 2024-01-04 · $5M · Flash Loan — LP Token Price Manipulation (Price Threshold Bypass) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Radiant Capital (1st incident) — Compound V2 / Aave V2 empty-market rounding error — new USDC market with totalSupply = 0 2024-01-02 · $5M · Compound V2 / Aave V2 empty-market rounding error — new USDC market with totalSupply = 0 · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Orbit Bridge (by Ozys) — Compromised Multisig Signer Keys (via rogue former CISO) 2023-12-31 · $82M · Compromised Multisig Signer Keys (via rogue former CISO) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Yearn Finance (legacy iearn TUSD V1 vault — deployed 2020) — Flash loan → misconfigured vault (TUSD vault tracking iSUSD/sUSD strategy) → share accounting inflation → Curve yPool drain 2023-12-16 · $293K · Flash loan → misconfigured vault (TUSD vault tracking iSUSD/sUSD strategy) → share accounting inflation → Curve yPool drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related OKX DEX (OKX Decentralized Exchange Aggregator) — Compromised proxy admin key → malicious implementation upgrade → claimTokens() drain of user approvals 2023-12-13 · $3M · Compromised proxy admin key → malicious implementation upgrade → claimTokens() drain of user approvals · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Levana Protocol — Oracle Price Delta Manipulation (Timing + Network Congestion) 2023-12-13 · $1M · Oracle Price Delta Manipulation (Timing + Network Congestion) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Yearn Finance (yETH LST stableswap pool + yETH-WETH Curve pool) — Invariant corruption via remove_liquidity(0) + update_rates() calls → Newton-Raphson arithmetic underflow → 235 trillion yETH minted from dust deposit → single-asset drain 2023-11-30 · $9M · Invariant corruption via remove_liquidity(0) + update_rates() calls → Newton-Raphson arithmetic underflow → 235 trillion yETH minted from dust deposit → single-asset drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal KyberSwap Elastic — Tick Manipulation + Double Liquidity Counting — Precision Arithmetic Edge Case 2023-11-22 · $48M · Tick Manipulation + Double Liquidity Counting — Precision Arithmetic Edge Case · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related HECO Bridge (Huobi ECO Chain Ethereum Bridge) — Compromised Bridge Operator Account (Private Key / Off-chain) 2023-11-22 · $87M · Compromised Bridge Operator Account (Private Key / Off-chain) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related dYdX v3 — Market Manipulation (Low-Liquidity Token — YFI Long + Spot Dump) 2023-11-20 · $9M · Market Manipulation (Low-Liquidity Token — YFI Long + Spot Dump) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Raft — Flash loan + collateral inflation via position liquidation → infinite R mint → stablecoin dump 2023-11-10 · $3M · Flash loan + collateral inflation via position liquidation → infinite R mint → stablecoin dump · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Anonymous MEV Sandwich Bot (on-chain MEV contract) — Unprotected public swap function → sandwich attack via Curve WETH/WBTC pool — $50M flash loan 2023-11-07 · $2M · Unprotected public swap function → sandwich attack via Curve WETH/WBTC pool — $50M flash loan · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: N/A]
related Unibot — Unvalidated arbitrary call in new router — transferFrom injection via approval drain 2023-10-31 · $640K · Unvalidated arbitrary call in new router — transferFrom injection via approval drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Onyx Protocol — Compound V2 empty-market donation attack — governance-added PEPE market exploited via rounding + exchange rate inflation 2023-10-31 · $2M · Compound V2 empty-market donation attack — governance-added PEPE market exploited via rounding + exchange rate inflation · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Fantom Foundation (employee wallets) — Off-chain Key Compromise (suspected password manager / phishing) 2023-10-17 · $8M · Off-chain Key Compromise (suspected password manager / phishing) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: N/A]
related Platypus Finance (3rd exploit) — Flash loan + LP-AVAX pool cash/liability manipulation → slippage-inflated swap output 2023-10-12 · $2M · Flash loan + LP-AVAX pool cash/liability manipulation → slippage-inflated swap output · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Stars Arena — Reentrancy 2023-10-07 · $3M · Reentrancy · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No]
related Mixin Network — Off-chain Cloud Database Breach → Hot Wallet / Private Key Compromise 2023-09-25 · $200M · Off-chain Cloud Database Breach → Hot Wallet / Private Key Compromise · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Hypr Network — Bridge Contract Reinitialization (OP Stack Unpatched Dev Branch) 2023-09-12 · $220K · Bridge Contract Reinitialization (OP Stack Unpatched Dev Branch) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: N/A]
related Exactly Protocol — Unvalidated market address in periphery — fake market injection → _msgSender hijack → collateral drain + reentrancy 2023-08-18 · $7M · Unvalidated market address in periphery — fake market injection → _msgSender hijack → collateral drain + reentrancy · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown (no mention in rekt.news article; $700K bounty offered post-hack for attacker information)]
related RocketSwap — Bruteforced server private keys → farming contract drain via proxy admin + high-risk permissions 2023-08-14 · $869K · Bruteforced server private keys → farming contract drain via proxy admin + high-risk permissions · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Zunami Protocol — Flash loan + SDT token swap → totalHoldings price calculation manipulation → zETH/UZD LP price manipulation → drain 2023-08-13 · $2M · Flash loan + SDT token swap → totalHoldings price calculation manipulation → zETH/UZD LP price manipulation → drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Steadefi — Compromised Deployer Key → Ownership Transfer 2023-08-07 · $1M · Compromised Deployer Key → Ownership Transfer · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Kannagi Finance — Insider rug — privileged admin withdrawal on behalf of users (MainChef address) 2023-07-29 · $1M · Insider rug — privileged admin withdrawal on behalf of users (MainChef address) · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related DeFiLabs — Backdoor Function in Staking Contract (Insider Rug Pull) 2023-07-27 · $2M · Backdoor Function in Staking Contract (Insider Rug Pull) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None mentioned]
related EraLend (formerly Nexon Finance) — Read-Only Reentrancy (SyncSwap LP Callback — Stale Reserves Oracle) 2023-07-25 · $3M · Read-Only Reentrancy (SyncSwap LP Callback — Stale Reserves Oracle) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Multichain (formerly Anyswap) — Private Key Compromise (MPC Address) — suspected backend breach or insider 2023-07-07 · $126M · Private Key Compromise (MPC Address) — suspected backend breach or insider · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Poly Network (2nd incident) — Compromised 3-of-4 multisig → forged deposit proofs → cross-chain withdrawal drain 2023-07-01 · $4M · Compromised 3-of-4 multisig → forged deposit proofs → cross-chain withdrawal drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Midas Capital — Compound V2 empty-market donation attack — exchange rate inflation + rounding error in redeemUnderlying 2023-06-17 · $600K · Compound V2 empty-market donation attack — exchange rate inflation + rounding error in redeemUnderlying · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Sturdy Finance — Read-only reentrancy on Balancer LP (B-stETH-STABLE) → manipulated collateral price → undercollateralized borrow drain 2023-06-12 · $800K · Read-only reentrancy on Balancer LP (B-stETH-STABLE) → manipulated collateral price → undercollateralized borrow drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Atlantis Loans — Governance attack on abandoned protocol — attacker passed malicious proposal granting token contract control, then upgraded to drain addresses with active approvals 2023-06-10 · $3M · Governance attack on abandoned protocol — attacker passed malicious proposal granting token contract control, then upgraded to drain addresses with active approvals · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None (project abandoned)]
causal Atomic Wallet (non-custodial multi-chain wallet) — Unknown officially; suspected: BGP hijacking combined with client-side vulnerability (possibly private key logging); Least Authority had flagged vulnerabilities in 2021 that were never addressed 2023-06-02 · $100M · Unknown officially; suspected: BGP hijacking combined with client-side vulnerability (possibly private key logging); Least Authority had flagged vulnerabilities in 2021 that were never addressed · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program]
related Jimbo's Protocol — Flash loan + missing slippage control in rebalancing function → liquidity drain 2023-05-28 · $8M · Flash loan + missing slippage control in rebalancing function → liquidity drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No (10% offered after hack via on-chain message)]
related Tornado Cash (Governance) — Metamorphic contract (CREATE + CREATE2 + selfDestruct) — trojan horse governance proposal 2023-05-20 · $750K · Metamorphic contract (CREATE + CREATE2 + selfDestruct) — trojan horse governance proposal · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: N/A (Tornado Cash is community-governed, no active bug bounty post-OFAC sanctions)]
related Swaprum — Rug Pull via Malicious Contract Upgrade 2023-05-18 · $3M · Rug Pull via Malicious Contract Upgrade · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Deus DAO / DEI stablecoin — Mis-ordered Parameters in burnFrom — Public Approval Override 2023-05-06 · $7M · Mis-ordered Parameters in burnFrom — Public Approval Override · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Level Finance — Logic bug — referral reward claimMultiple() epoch not checked for reuse 2023-05-01 · $1M · Logic bug — referral reward claimMultiple() epoch not checked for reuse · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Merlin DEX — Insider rug — max approval drain via privileged Feeto address 2023-04-25 · $2M · Insider rug — max approval drain via privileged Feeto address · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No]
related Yearn Finance (iearn yUSDT) — Misconfiguration (copy/paste error) in yUSDT — wrong Fulcrum USDC address used instead of USDT → share price manipulation → 1.2 quadrillion yUSDT minted 2023-04-13 · $10M · Misconfiguration (copy/paste error) in yUSDT — wrong Fulcrum USDC address used instead of USDT → share price manipulation → 1.2 quadrillion yUSDT minted · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Yearn has a bug bounty; immutable contract meant no patch was possible even with disclosure]
related Safemoon — Upgrade introduced public burn() function → LP token burn → pool price manipulation → BNB drain 2023-03-28 · $9M · Upgrade introduced public burn() function → LP token burn → pool price manipulation → BNB drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Kokomo Finance — Insider rug — deployer upgraded implementation to malicious contract → drained WBTC deposits 2023-03-26 · $4M · Insider rug — deployer upgraded implementation to malicious contract → drained WBTC deposits · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related Hedera (Network-level — Hashgraph Smart Contract Service) — Smart Contract Service (HTS) Code Bug — Uniswap V2 Port Exploit 2023-03-09 · $515K · Smart Contract Service (HTS) Code Bug — Uniswap V2 Port Exploit · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Hope Finance — Insider Exit Scam — Malicious Fake Router Pre-Deployed 2023-02-20 · $2M · Insider Exit Scam — Malicious Fake Router Pre-Deployed · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No]
related Dexible — Unvalidated router — selfSwap() transferFrom injection via approval drain 2023-02-17 · $2M · Unvalidated router — selfSwap() transferFrom injection via approval drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown / not mentioned]
related Platypus Finance — Flash loan + emergencyWithdraw() solvency check bypass — collateral withdrawal without repaying borrowed USP 2023-02-16 · $9M · Flash loan + emergencyWithdraw() solvency check bypass — collateral withdrawal without repaying borrowed USP · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related dForce Network — Read-Only Reentrancy (Curve wstETH/ETH LP Oracle Manipulation) 2023-02-13 · $4M · Read-Only Reentrancy (Curve wstETH/ETH LP Oracle Manipulation) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Orion Protocol — Fake token reentrancy — depositAsset() double-credit via ATK token transfer hook 2023-02-02 · $3M · Fake token reentrancy — depositAsset() double-credit via ATK token transfer hook · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Midas Capital — Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation 2023-01-15 · $660K · Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Lodestar Finance — Oracle Price Manipulation (LP Token Donation) 2022-12-10 · $7M · Oracle Price Manipulation (LP Token Donation) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown — team asked hacker to negotiate white-hat]
related Team Finance — Flawed migrate() function — Uniswap V2→V3 migration with skewed price manipulation 2022-10-27 · $16M · Flawed migrate() function — Uniswap V2→V3 migration with skewed price manipulation · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Moola Markets — Price Manipulation (Native Token Collateral) 2022-10-19 · $8M · Price Manipulation (Native Token Collateral) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Sovryn — External call reentrancy via callTokensToSend — token price inflation via mid-transaction mint → overclaim via burn 2022-10-04 · $1M · External call reentrancy via callTokensToSend — token price inflation via mid-transaction mint → overclaim via burn · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Transit Swap — Controllable transferFrom() in unverified (closed-source) swap contract — approval drain 2022-10-01 · $21M · Controllable transferFrom() in unverified (closed-source) swap contract — approval drain · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program]
related 0xbad MEV Bot (on-chain MEV arbitrage contract) — Unprotected flashloan callback — arbitrary execution via callFunction → WETH approval exploit 2022-09-27 · $2M · Unprotected flashloan callback — arbitrary execution via callFunction → WETH approval exploit · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: N/A]
related Nomad Bridge — Initialisation Error — Zero-Address Trusted Root (Merkle Proof Bypass) 2022-08-02 · $190M · Initialisation Error — Zero-Address Trusted Root (Merkle Proof Bypass) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Nirvana Finance — Flash Loan + AMM Price Manipulation (Treasury Drain) 2022-07-28 · $4M · Flash Loan + AMM Price Manipulation (Treasury Drain) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Harmony Horizon Bridge — Compromised Multisig Private Keys (Hot Wallets) 2022-06-23 · $100M · Compromised Multisig Private Keys (Hot Wallets) · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Inverse Finance — Oracle Price Manipulation (Flash Loan) 2022-06-16 · $6M · Oracle Price Manipulation (Flash Loan) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Gym Network (GymNet) — Missing caller verification — fake deposits via unchecked balance inflation → withdraw drain 2022-06-10 · $2M · Missing caller verification — fake deposits via unchecked balance inflation → withdraw drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Mirror Protocol (REKT 2) — Missing Duplicate-Call Check (Re-entrancy variant) 2022-05-31 · $92M · Missing Duplicate-Call Check (Re-entrancy variant) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Fortress Protocol (lending arm of JetFuel Finance) — Oracle Manipulation + Malicious Governance Proposal 2022-05-09 · $3M · Oracle Manipulation + Malicious Governance Proposal · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Mad Meerkat Finance (MM.Finance) — DNS Hijack / Front-End Attack (Router Address Substitution) 2022-05-04 · $2M · DNS Hijack / Front-End Attack (Router Address Substitution) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Saddle Finance — Flash Loan + LP Token Price Manipulation (Old MetaSwapUtils Library) 2022-05-01 · $11M · Flash Loan + LP Token Price Manipulation (Old MetaSwapUtils Library) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Fei Protocol / Rari Capital (Fuse) — Re-entrancy via `exitMarket()` in Compound fork missing check-effects-interaction pattern 2022-04-30 · $80M · Re-entrancy via `exitMarket()` in Compound fork missing check-effects-interaction pattern · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Beanstalk — Flash Loan + Governance Exploit 2022-04-17 · $181M · Flash Loan + Governance Exploit · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty existed (Y/N): Unknown — not mentioned in source] || Bug bounty absent — alternate field name [via dashboard_risk_factors/Bug bounty existed (Y/N): Unknown — not mentioned in source]
causal Elephant Money — Flash loan + spot price manipulation during stablecoin minting 2022-04-12 · $22M · Flash loan + spot price manipulation during stablecoin minting · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No evidence]
causal Inverse Finance — SushiSwap TWAP Oracle Manipulation — Thin Liquidity Governance Token 2022-04-02 · $16M · SushiSwap TWAP Oracle Manipulation — Thin Liquidity Governance Token · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Voltage Finance / Ola Finance — ERC677 callAfterTransfer() reentrancy in Compound fork — borrow before balance update 2022-03-31 · $4M · ERC677 callAfterTransfer() reentrancy in Compound fork — borrow before balance update · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Ronin Network (Bridge) — Compromised Validator Keys + Unrevoked Whitelist Access 2022-03-29 · $624M · Compromised Validator Keys + Unrevoked Whitelist Access · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Revest Finance — ERC1155 reentrancy via onERC1155Received — fnftId update timing flaw inflates FNFT redemption value 2022-03-27 · $2M · ERC1155 reentrancy via onERC1155Received — fnftId update timing flaw inflates FNFT redemption value · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Cashio — Infinite mint via incomplete collateral validation — fake account chain bypasses all verification 2022-03-23 · $48M · Infinite mint via incomplete collateral validation — fake account chain bypasses all verification · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program]
related Agave DAO + Hundred Finance (dual attack) — ERC677 callAfterTransfer() reentrancy — flash loan collateral → nested borrow calls before debt balance update → multi-asset drain 2022-03-15 · $12M · ERC677 callAfterTransfer() reentrancy — flash loan collateral → nested borrow calls before debt balance update → multi-asset drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Agave: Yes (Aave-like program); Hundred: Unknown]
related Deus DAO (1st incident) — Flash loan → spot price manipulation of Solidex USDC/DEI AMM pool (used as oracle) → user positions liquidated 2022-03-15 · $3M · Flash loan → spot price manipulation of Solidex USDC/DEI AMM pool (used as oracle) → user positions liquidated · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None identified]
related Deus DAO (DEI lending contract) — Flash loan oracle manipulation via Solidly AMM pool → user position liquidation 2022-03-15 · $3M · Flash loan oracle manipulation via Solidly AMM pool → user position liquidation · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None identified]
related Treasure DAO (Marketplace) — Logic Bug (Zero-Quantity Purchase) 2022-03-03 · $1M · Logic Bug (Zero-Quantity Purchase) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Dego Finance + Cocos-BCX — Compromised Private Key — Multi-chain LP Drain + Token Mint 2022-02-10 · $10M · Compromised Private Key — Multi-chain LP Drain + Token Mint · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Superfluid — Composability Exploit (ctx Manipulation) 2022-02-08 · $9M · Composability Exploit (ctx Manipulation) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Meter (Passport Bridge) — Deposit method calldata bypass — unwrapped native token assumption not enforced in secondary deposit path 2022-02-05 · $8M · Deposit method calldata bypass — unwrapped native token assumption not enforced in secondary deposit path · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Arbix Finance — Insider rug pull — deployer drained user vaults and disappeared, then dumped native token via PancakeSwap 2022-01-04 · $10M · Insider rug pull — deployer drained user vaults and disappeared, then dumped native token via PancakeSwap · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Visor Finance — Vulnerable require() in vVISR deposit() — self-referential ownership bypass → unlimited share minting 2021-12-22 · $8M · Vulnerable require() in vVISR deposit() — self-referential ownership bypass → unlimited share minting · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Grim Finance — Reentrancy 2021-12-18 · $30M · Reentrancy · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related BrincFi — Insider backdoor — rescueTokens() admin drain via ownership transfer + malicious contract upgrade 2021-12-14 · $1M · Insider backdoor — rescueTokens() admin drain via ownership transfer + malicious contract upgrade · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related 8ight Finance — Admin key compromise — private key shared via Facebook chat and Google Drive → treasury drain 2021-12-07 · $2M · Admin key compromise — private key shared via Facebook chat and Google Drive → treasury drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
causal Badger DAO (Bitcoin-yield vaults on Ethereum) — Front-end injection (Cloudflare account compromise) → malicious `increaseAllowance()` approvals → vault token drain 2021-12-02 · $120M · Front-end injection (Cloudflare account compromise) → malicious `increaseAllowance()` approvals → vault token drain · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program]
causal MonoX — Native token self-swap price inflation — tokenIn/tokenOut identity bypass 2021-11-30 · $31M · Native token self-swap price inflation — tokenIn/tokenOut identity bypass · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Snowdog (SnowdogDAO) — Insider front-running — privileged challengeKey knowledge + custom AMM sniping 2021-11-25 · $21M · Insider front-running — privileged challengeKey knowledge + custom AMM sniping · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program]
causal Indexed Finance — Flash Loan — Rebalancing Delay Pool Oracle Manipulation 2021-10-14 · $16M · Flash Loan — Rebalancing Delay Pool Oracle Manipulation · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Vee Finance — Pangolin spot price oracle manipulation via custom trading pairs + decimal handling bug 2021-09-21 · $34M · Pangolin spot price oracle manipulation via custom trading pairs + decimal handling bug · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown (team offered bug bounty to hacker post-attack)]
related DAO Maker — Reinitializable init() function + emergencyExit() drain on token vesting contracts 2021-09-04 · $4M · Reinitializable init() function + emergencyExit() drain on token vesting contracts · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None identified]
related xToken Market — Public callFunction() in xSNXAdmin — same SNX price manipulation, different access control bug 2021-08-30 · $5M · Public callFunction() in xSNXAdmin — same SNX price manipulation, different access control bug · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Cream Finance — ERC-777 Reentrancy (Token Integration Vulnerability) 2021-08-30 · $19M · ERC-777 Reentrancy (Token Integration Vulnerability) · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown — not mentioned in post-mortem]
related Poly Network — Cross-chain Message Forgery — Privileged Contract Caller Manipulation 2021-08-11 · $611M · Cross-chain Message Forgery — Privileged Contract Caller Manipulation · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Popsicle Finance (Sorbetto Fragola) — Fee Accounting Bug — LP Token Transfer Without Reward Checkpoint 2021-08-04 · $20M · Fee Accounting Bug — LP Token Transfer Without Reward Checkpoint · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related THORChain — Fake deposit via fake Asgard vault + malicious memo — Bifrost refund logic abuse 2021-07-26 · $8M · Fake deposit via fake Asgard vault + malicious memo — Bifrost refund logic abuse · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No (hacker demanded 10% bounty be established; THORChain committed to one post-incident)]
related PancakeBunny (Polygon deployment — polyBUNNY) — Flash Loan + Reward Minting Manipulation (Performance Fee Inflation) 2021-07-18 · $2M · Flash Loan + Reward Minting Manipulation (Performance Fee Inflation) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related THORChain — ETH Bifrost override loop — msg.value spoofing via wrapped router 2021-07-16 · $5M · ETH Bifrost override loop — msg.value spoofing via wrapped router · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No — hacker noted explicitly in the exploit that "10% VAR bounty would have prevented this"; THORChain had paused bounty refresh for MCCN]
related ChainSwap — Auth bypass in Factory minting contract — sloppy signature check bypassed with fresh addresses 2021-07-11 · $4M · Auth bypass in Factory minting contract — sloppy signature check bypassed with fresh addresses · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None identified]
related Merlin Labs (REKT 3) — Reward Minting Manipulation (Balance Inflation) 2021-06-29 · $330K · Reward Minting Manipulation (Balance Inflation) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Levyathan Finance — Exposed Private Key + Minting + emergencyWithdraw Bug 2021-06-01 · $2M · Exposed Private Key + Minting + emergencyWithdraw Bug · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None]
related AutoShark Finance — Flash loan + SharkMinter balance spoofing → excess native token minting 2021-06-01 · $745K · Flash loan + SharkMinter balance spoofing → excess native token minting · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None identified]
related BurgerSwap — Reentrancy via non-standard BEP-20 + missing x*y=k invariant check 2021-05-28 · $7M · Reentrancy via non-standard BEP-20 + missing x*y=k invariant check · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None identified]
related Merlin Labs (REKT 2) — Oracle Mispricing 2021-05-27 · $550K · Oracle Mispricing · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Merlin Labs — External token balance spoofing → excess native token minting 2021-05-26 · $680K · External token balance spoofing → excess native token minting · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown / not mentioned]
causal PancakeBunny — Flash loan + spot price manipulation → inflated LP token valuation → excess BUNNY minting 2021-05-19 · $45M · Flash loan + spot price manipulation → inflated LP token valuation → excess BUNNY minting · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal bEarnFi (BvaultsBank) — Logic bug — token denomination mismatch between vault and strategy layers 2021-05-16 · $18M · Logic bug — token denomination mismatch between vault and strategy layers · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown — not mentioned in report]
related xToken Market — Flash loan + SNX/BNT price manipulation → xSNX/xBNT share price inflation → drain 2021-05-12 · $24M · Flash loan + SNX/BNT price manipulation → xSNX/xBNT share price inflation → drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Value DeFi — Bancor Power Function Misuse (Weighted AMM Invariant Bypass) 2021-05-08 · $11M · Bancor Power Function Misuse (Weighted AMM Invariant Bypass) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Rari Capital — Fake token + protocol callback exploit (ibETH injection via Alpha Homora) → ETH pool drain 2021-05-08 · $10M · Fake token + protocol callback exploit (ibETH injection via Alpha Homora) → ETH pool drain · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Value DeFi — Uninitialized Pool Re-initialization (Missing initialized = true) 2021-05-05 · $10M · Uninitialized Pool Re-initialization (Missing initialized = true) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal EasyFi (Easy Network) — Admin key theft via compromised machine (malicious MetaMask binary) 2021-04-19 · $59M · Admin key theft via compromised machine (malicious MetaMask binary) · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No evidence of bug bounty program at time of hack]
related PAID Network — Infinite Mint — Compromised Deployer Key (Suspected Insider) 2021-03-05 · $27M · Infinite Mint — Compromised Deployer Key (Suspected Insider) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Furucombo — Evil Contract — Delegatecall Storage Collision 2021-02-27 · $14M · Evil Contract — Delegatecall Storage Collision · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Alpha Finance / Alpha Homora V2 (leveraged yield farming) — Debt accounting manipulation via rounding bug + public `resolveReserve` function + custom "evil spell"; insider knowledge of unannounced sUSD pool required 2021-02-13 · $38M · Debt accounting manipulation via rounding bug + public `resolveReserve` function + custom "evil spell"; insider knowledge of unannounced sUSD pool required · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program]
related BT Finance + Growth DeFi (two separate hacks, one article) — BT Finance: Flash Loan Price Manipulation; Growth DeFi: Fake Token LP Injection 2021-02-09 · $2M · BT Finance: Flash Loan Price Manipulation; Growth DeFi: Fake Token LP Injection · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown (both)]
related Yearn Finance (yDAI v1 vault) — Flash loan + Curve 3pool spot price manipulation → vault share price arbitrage → DAI drain during migration 2021-02-04 · $11M · Flash loan + Curve 3pool spot price manipulation → vault share price arbitrage → DAI drain during migration · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown at time of exploit]
related Warp Finance — Flash loan + Uniswap V2 LP token spot oracle manipulation → inflated collateral → over-borrow drain 2020-12-17 · $8M · Flash loan + Uniswap V2 LP token spot oracle manipulation → inflated collateral → over-borrow drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown; attacker left collateral locked creating a natural bounty for liquidation]
related Compounder Finance — Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull) 2020-12-02 · $12M · Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull) · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: None mentioned]
causal Pickle Finance — Fake jar injection — missing whitelist in Controller's jar-swap function 2020-11-22 · $20M · Fake jar injection — missing whitelist in Controller's jar-swap function · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
related Value DeFi — Flash loan + Curve spot price oracle manipulation → inflated collateral → over-borrow drain 2020-11-14 · $7M · Flash loan + Curve spot price oracle manipulation → inflated collateral → over-borrow drain · Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: Unknown]
causal Eminence Finance (EMN) — Flash loan + bonding curve arbitrage (buy/burn/sell cycle) 2020-09-28 · $15M · Flash loan + bonding curve arbitrage (buy/burn/sell cycle) · Direct: bug bounty presence + max payout [via cross-hack: Factor 9: No Bug Bounty Program] || Bug bounty absent — baseline integrity gap [via dashboard_risk_factors/Bug bounty: No]
rubric_version v1.7.0 factor RD-F-007 category 1 carried 0 critical no