Prior exploit count

A operational history factor in the v1.7.0 rubric. Measured per protocol on a e cadence.

Methodology how we score #

What this measures
This factor counts the total number of distinct in-sample hack incidents affecting this protocol, as recorded in the hacks database with post-mortems completed. Each incident counts once regardless of loss size. The count is updated whenever a new incident is confirmed and post-mortemed. It is the primary input to the chronic-flag calculation (RD-F-078) and feeds directly into the protocol-level badge assignment.

Why it matters
A protocol that has been successfully exploited once has demonstrated at minimum one exploitable vulnerability in its codebase or operational posture. Six protocols in the dataset were exploited more than once, and in four of those cases the second exploit arrived within twelve months of the first -- either by bypassing an incomplete fix or by targeting a different but equally serious weakness. The prior-exploit count is a leading indicator of security-culture deficiency: it signals that either the code-quality bar is insufficient, the upgrade discipline is weak, or operational security is persistently below peer standards.

Green / Yellow / Red
Green: zero prior exploits in the database. Yellow: one prior exploit with a documented remediation, a re-audit, and no same-root-cause recurrence for at least twelve months. Red: two or more prior exploits, or one prior exploit without documented remediation or re-audit.

Common gray cases
Near-miss events (governance proposals voted down before execution, white-hat interventions with full fund recovery) are not counted as incidents unless the underlying vulnerability was successfully triggered even briefly. Curator judgment is required on partial-drain incidents where root cause is unconfirmed.

Notable historical examples
- Compound Finance ($147M, 2021): Second incident in twelve months; governance upgrade introduced the drip() vulnerability on an already-exploited Comptroller.
- Radiant Capital ($53M, 2024): Second incident targeting an entirely different vector (multisig key compromise) than the first (flash loan attack).
- AlexLab ($16.18M, 2025): Second exploit via vault permission hijack; first was a private key compromise, indicating independent systemic gaps.
- Abracadabra Money ($13M, 2025): Second incident via phantom collateral in a gmCauldron upgrade; different vector from first.
- Platypus Finance ($8.5M, 2023): Part of a pattern of three incidents in eight months.

Measurement what to look for #

Count the number of distinct incidents in the hack database affecting this protocol.

Data & output #

Data source

In-house hack DB + rekt.news + DeFiLlama hacks API + protocol post-mortems

Output format

Green / Yellow / Red

Evidence artifact

List of incident dates + loss USD + source URL per incident

Confidence signal

green = 0 prior exploits; yellow = 1 prior exploit with full recovery; red = ≥2 exploits or any unrecovered loss; gray = protocol history not researched

Scored protocols 0 carry this factor #

No protocols have been scored for this factor yet.

Linked hacks 12 historical incidents #

causal AlexLab (Bitcoin DeFi / Stacks) — Vault permission hijack via malicious token self-listing; `as-contract` context abuse 2025-06-06 · $16M · Vault permission hijack via malicious token self-listing; `as-contract` context abuse · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Abracadabra Money — Logic bug — phantom collateral / post-liquidation state inconsistency 2025-03-25 · $13M · Logic bug — phantom collateral / post-liquidation state inconsistency · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Radiant Capital — Compromised multisig private keys → malicious contract upgrade → pool ownership transfer → drain 2024-10-16 · $53M · Compromised multisig private keys → malicious contract upgrade → pool ownership transfer → drain · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Onyx Protocol — Compound V2 empty-market donation attack — governance-added PEPE market exploited via rounding + exchange rate inflation 2023-10-31 · $2M · Compound V2 empty-market donation attack — governance-added PEPE market exploited via rounding + exchange rate inflation · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Deus DAO / DEI stablecoin — Mis-ordered Parameters in burnFrom — Public Approval Override 2023-05-06 · $7M · Mis-ordered Parameters in burnFrom — Public Approval Override · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Level Finance — Logic bug — referral reward claimMultiple() epoch not checked for reuse 2023-05-01 · $1M · Logic bug — referral reward claimMultiple() epoch not checked for reuse · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Hundred Finance — ERC-4626-style cToken exchange rate manipulation + rounding error 2023-04-15 · $7M · ERC-4626-style cToken exchange rate manipulation + rounding error · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Platypus Finance — Flash loan + emergencyWithdraw() solvency check bypass — collateral withdrawal without repaying borrowed USP 2023-02-16 · $9M · Flash loan + emergencyWithdraw() solvency check bypass — collateral withdrawal without repaying borrowed USP · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Midas Capital — Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation 2023-01-15 · $660K · Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal DAO Maker — Reinitializable init() function + emergencyExit() drain on token vesting contracts 2021-09-04 · $4M · Reinitializable init() function + emergencyExit() drain on token vesting contracts · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Merlin Labs (REKT 2) — Oracle Mispricing 2021-05-27 · $550K · Oracle Mispricing · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

causal Uranium Finance — Math bug — constant product formula check broken by inconsistent parameter change (1000→10000) 2021-04-28 · $57M · Math bug — constant product formula check broken by inconsistent parameter change (1000→10000) · Prior exploit count [via cross-hack: Factor 5: Second Exploit on Same Protocol]

rubric_version v1.7.0 factor RD-F-077 category 5 carried 0 critical no