defirisk.co
rubric v1.7.0

Is-a-fork-of

A fork / dependency lineage factor in the v1.7.0 rubric. Measured per protocol on a s cadence.

Methodology how we score #

What this measures
This factor identifies the upstream protocol that the assessed protocol forked from, if any. The determination is made via bytecode similarity comparison, function selector set analysis, and explicit declarations in the protocol's documentation or README. A fork relationship is recorded when at least 60% of core contract bytecode matches a known upstream, or when the team explicitly declares a fork origin. The upstream identity is stored as a structured reference (e.g., 'Compound Finance v2', 'Aave v3') and drives downstream factors in Category 8.

Why it matters
Fork lineage is the anchor for the entire Category 8 assessment: knowing the upstream source determines which known vulnerability classes are relevant, which patches need to be verified as merged, and what audit gap exists between the upstream's security review and the fork's deployment. The cross-hack dataset shows that forked protocols are disproportionately represented in exploit records -- Compound forks alone account for at least four separate exploits of the same CEI reentrancy pattern across Cream Finance, Hundred Finance, Fei/Rari Fuse, and Voltage/Ola. A fork with a clear, well-known lineage gets a more precise risk assessment; an undisclosed or obfuscated fork origin is itself a risk indicator.

Green / Yellow / Red
Green: the protocol explicitly discloses its upstream fork source with a specific commit hash or version reference, and the declared lineage is confirmed by bytecode similarity analysis. Yellow: the protocol acknowledges it is a fork but does not specify the upstream version or commit; lineage is determined by curator analysis. Red: the protocol does not disclose fork status but bytecode similarity analysis indicates a fork of a known protocol, suggesting undisclosed lineage (a transparency risk). Alternatively: no fork (original code) is Green for this field specifically.

Common gray cases
This factor is gray only when the protocol's source code is not verified and bytecode similarity analysis cannot be reliably performed. For fully novel protocols with no fork origin, the field value is 'Original' (not gray).

Notable historical examples
- Compound Finance ($147M, 2021): Original; the source of downstream forks exploited via the same CEI reentrancy pattern.
- Fei/Rari Fuse ($80M, 2022): Compound Finance fork; exploited via the same exitMarket() reentrancy present in the upstream.
- EasyFi ($59M, 2021): Compound Finance fork; admin key risk inherited from fork architecture.
- Radiant Capital ($53M, 2024): Aave v2 fork; multisig compromise risk not mitigated by the fork's governance changes.
- Uranium Finance ($57.2M, 2021): Uniswap V2 fork on BSC; constant-product invariant modification introduced the exploited vulnerability.

Measurement what to look for #

Identify the upstream protocol this is a fork of (if any) via bytecode similarity, function-selector set overlap, or team declaration.

Data & output #

Data source
Bytecode similarity tool (Etherscan bytecode compare / Slither inheritance graph) + GitHub fork detection + protocol docs
Output format
Green / Yellow / Red
Evidence artifact
Upstream protocol name + similarity score or declaration URL
Confidence signal
green = upstream clearly identified and documented; yellow = strong similarity but no explicit declaration; red = upstream not declared but bytecode similarity >80% (hidden fork); gray = not a fork (N/A) or similarity tool inconclusive

Scored protocols 0 carry this factor #

No protocols have been scored for this factor yet.

Linked hacks 87 historical incidents #

causal Dango (custom-L1 perpetual DEX; Grug engine on Tendermint) — Missing sign/positivity check on `donate()` input in the insurance-fund contract — negative value reversed accounting direction 2026-04-13 · $2M · Missing sign/positivity check on `donate()` input in the insurance-fund contract — negative value reversed accounting direction · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: N — from-scratch L1 using custom Grug engine; not a fork of Hyperliquid, dYdX, or any existing perp DEX]
causal Silo Finance (V2, soUSDC managed vault on Arbitrum) — Immutable hardcoded wstUSR oracle (pricing depegged asset ~10x reality) + supply-cap bypass via `receiver` parameter + `totalAssets()` summing externally-donated shares 2026-04-03 · $392K · Immutable hardcoded wstUSR oracle (pricing depegged asset ~10x reality) + supply-cap bypass via `receiver` parameter + `totalAssets()` summing externally-donated shares · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: N — original protocol; V2 meta-vault pattern is conceptually similar to MetaMorpho but not a fork]
causal Moonwell — Oracle Misconfiguration (Missing ETH/USD Multiplier) 2026-02-15 · $2M · Oracle Misconfiguration (Missing ETH/USD Multiplier) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Compound V2 fork]
causal Saga (SagaEVM / Saga Dollar) — IBC Precompile Input Validation Bypass → Infinite Mint 2026-01-21 · $7M · IBC Precompile Input Validation Bypass → Infinite Mint · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — built on Ethermint (Cosmos EVM layer); vulnerability confirmed to originate there]
causal TMXTribe — Logic Bug — Mint/Stake/Swap Loop 2026-01-05 · $1M · Logic Bug — Mint/Stake/Swap Loop · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — GMX fork]
causal Shibarium (Bridge) — Flash Loan Validator Capture → Fraudulent Checkpoint → Bridge Drain 2025-09-12 · $3M · Flash Loan Validator Capture → Fraudulent Checkpoint → Bridge Drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Polygon PoS-derived architecture]
causal Credix — Admin Privilege Abuse — Bridge Role Minting Unbacked Collateral 2025-08-05 · $5M · Admin Privilege Abuse — Bridge Role Minting Unbacked Collateral · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Appears to be an Aave-style lending architecture (ACLManager, POOL_ADMIN, BRIDGE roles are characteristic of Aave v3); fork of Aave v3 archi...]
causal ResupplyFi — ERC4626 Donation Attack (Vault Inflation / Zero Exchange Rate) 2025-06-25 · $10M · ERC4626 Donation Attack (Vault Inflation / Zero Exchange Rate) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — integrates crvUSD/Curve infrastructure; ERC4626-based]
causal LNDFi (LND.fi) — Admin Backdoor (Malicious Code Injection by Contractor / DPRK Dev) 2025-05-09 · $1M · Admin Backdoor (Malicious Code Injection by Contractor / DPRK Dev) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Aave V3 fork]
causal Loopscale (formerly Bridgesplit) — Oracle Price Manipulation (RateX PT Token Pricing) 2025-04-26 · $6M · Oracle Price Manipulation (RateX PT Token Pricing) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Original protocol (not a fork)]
causal Zoth (RWA yield protocol) — Admin key compromise → malicious proxy contract upgrade → vault drain 2025-03-21 · $8M · Admin key compromise → malicious proxy contract upgrade → vault drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Unknown — RWA yield protocol; specific fork status not referenced]
causal Polter Finance — Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow 2024-11-16 · $9M · Spot price oracle manipulation (SpookySwap V2/V3) → inflated BOO collateral → draining borrow · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — fork of Geist Finance (itself an Aave fork)]
causal Radiant Capital — Compromised multisig private keys → malicious contract upgrade → pool ownership transfer → drain 2024-10-16 · $53M · Compromised multisig private keys → malicious contract upgrade → pool ownership transfer → drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Aave v2 fork]
causal Onyx Protocol (2nd incident) — Compound V2 empty-market donation attack — VUSD governance-added market 2024-09-25 · $4M · Compound V2 empty-market donation attack — VUSD governance-added market · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Compound V2 fork]
causal Griffin AI ($GAIN token) — Fake LayerZero Peer Initialization (Cross-Chain Minting Exploit) 2024-09-24 · $3M · Fake LayerZero Peer Initialization (Cross-Chain Minting Exploit) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Uses LayerZero OFT standard (not a fork per se, but relies on shared infrastructure)]
causal Astroport (on Terra Phoenix chain) — IBC hooks reentrancy — reintroduced known vulnerability in June upgrade after April patch; timeout callback re-enters token minting 2024-07-30 · $6M · IBC hooks reentrancy — reintroduced known vulnerability in June upgrade after April patch; timeout callback re-enters token minting · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Astroport is a fork of its own earlier version; Terra using custom ibc-go fork]
causal ETHTrustFund (ETF) — Insider Rug Pull — Deployer Drains Treasury Smart Contract 2024-07-21 · $2M · Insider Rug Pull — Deployer Drains Treasury Smart Contract · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — OHM (Olympus DAO) fork; rebasing bond mechanism]
causal Rho Market — Oracle misconfiguration (deployment error) → MEV bot price manipulation → USDC/USDT drain 2024-07-19 · Oracle misconfiguration (deployment error) → MEV bot price manipulation → USDC/USDT drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Compound Finance fork]
causal Velocore — Fee Multiplier Manipulation + Underflow → Liquidity Token Mint 2024-06-02 · $7M · Fee Multiplier Manipulation + Underflow → Liquidity Token Mint · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Balancer-style CPMM architecture]
causal Sonne Finance — Compound V2 empty-market donation attack — permissionless governance execution + exchange rate manipulation 2024-05-14 · $20M · Compound V2 empty-market donation attack — permissionless governance execution + exchange rate manipulation · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Compound V2 fork]
causal PrismaFi — Flash Loan + Missing Input Validation (Migration Helper) 2024-03-28 · $12M · Flash Loan + Missing Input Validation (Migration Helper) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — fork of Liquity Protocol with modifications]
causal Curio (CurioDAO) — Voting power privilege escalation via MakerDAO fork governance bug → mass CGT token minting 2024-03-23 · $16M · Voting power privilege escalation via MakerDAO fork governance bug → mass CGT token minting · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked: YES** — MakerDAO governance fork (IDSChief, IDSPause)]
causal Seneca Protocol — Approval Exploit — Arbitrary transferFrom via Constructed Calldata 2024-02-28 · $6M · Approval Exploit — Arbitrary transferFrom via Constructed Calldata · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — "battle-tested code" (their words); LST collateral CDP fork]
causal Ionic Money (formerly Midas) — Fake Collateral Listing (Social Engineering → On-chain Exploit) 2024-02-04 · $7M · Fake Collateral Listing (Social Engineering → On-chain Exploit) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Midas was a lending protocol; architecture similar to Compound forks]
causal Radiant Capital (1st incident) — Compound V2 / Aave V2 empty-market rounding error — new USDC market with totalSupply = 0 2024-01-02 · $5M · Compound V2 / Aave V2 empty-market rounding error — new USDC market with totalSupply = 0 · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Aave V2 fork]
causal Levana Protocol — Oracle Price Delta Manipulation (Timing + Network Congestion) 2023-12-13 · $1M · Oracle Price Delta Manipulation (Timing + Network Congestion) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Original protocol (not a fork)]
causal Yearn Finance (yETH LST stableswap pool + yETH-WETH Curve pool) — Invariant corruption via remove_liquidity(0) + update_rates() calls → Newton-Raphson arithmetic underflow → 235 trillion yETH minted from dust deposit → single-asset drain 2023-11-30 · $9M · Invariant corruption via remove_liquidity(0) + update_rates() calls → Newton-Raphson arithmetic underflow → 235 trillion yETH minted from dust deposit → single-asset drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: N — custom stableswap math, not a fork of standard Curve]
causal Onyx Protocol — Compound V2 empty-market donation attack — governance-added PEPE market exploited via rounding + exchange rate inflation 2023-10-31 · $2M · Compound V2 empty-market donation attack — governance-added PEPE market exploited via rounding + exchange rate inflation · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Compound Finance fork]
causal Stars Arena — Reentrancy 2023-10-07 · $3M · Reentrancy · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — FriendTech clone]
causal Hypr Network — Bridge Contract Reinitialization (OP Stack Unpatched Dev Branch) 2023-09-12 · $220K · Bridge Contract Reinitialization (OP Stack Unpatched Dev Branch) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — OP Stack fork (Optimism)]
causal Steadefi — Compromised Deployer Key → Ownership Transfer 2023-08-07 · $1M · Compromised Deployer Key → Ownership Transfer · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — leveraged yield farming model similar to Alpaca Finance, Beefy]
causal EraLend (formerly Nexon Finance) — Read-Only Reentrancy (SyncSwap LP Callback — Stale Reserves Oracle) 2023-07-25 · $3M · Read-Only Reentrancy (SyncSwap LP Callback — Stale Reserves Oracle) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — code recycled from SyncSwap; lending architecture borrowed from established patterns]
causal Midas Capital — Compound V2 empty-market donation attack — exchange rate inflation + rounding error in redeemUnderlying 2023-06-17 · $600K · Compound V2 empty-market donation attack — exchange rate inflation + rounding error in redeemUnderlying · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Compound V2 / Fuse fork]
causal Atlantis Loans — Governance attack on abandoned protocol — attacker passed malicious proposal granting token contract control, then upgraded to drain addresses with active approvals 2023-06-10 · $3M · Governance attack on abandoned protocol — attacker passed malicious proposal granting token contract control, then upgraded to drain addresses with active approvals · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Likely a Compound/Aave fork (BSC lending)]
causal Swaprum — Rug Pull via Malicious Contract Upgrade 2023-05-18 · $3M · Rug Pull via Malicious Contract Upgrade · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — standard AMM fork]
causal Merlin DEX — Insider rug — max approval drain via privileged Feeto address 2023-04-25 · $2M · Insider rug — max approval drain via privileged Feeto address · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — concentrated liquidity DEX; custom code for zkSync]
causal Hundred Finance — ERC-4626-style cToken exchange rate manipulation + rounding error 2023-04-15 · $7M · ERC-4626-style cToken exchange rate manipulation + rounding error · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Compound V2 fork]
causal SushiSwap — Malicious Callback / Arbitrary Approval Drain 2023-04-08 · $3M · Malicious Callback / Arbitrary Approval Drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — originally forked from Uniswap V2]
causal Safemoon — Upgrade introduced public burn() function → LP token burn → pool price manipulation → BNB drain 2023-03-28 · $9M · Upgrade introduced public burn() function → LP token burn → pool price manipulation → BNB drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — BEP-20 token with custom transfer mechanics (PancakeSwap liquidity)]
causal Kokomo Finance — Insider rug — deployer upgraded implementation to malicious contract → drained WBTC deposits 2023-03-26 · $4M · Insider rug — deployer upgraded implementation to malicious contract → drained WBTC deposits · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Compound V2 fork]
causal Hope Finance — Insider Exit Scam — Malicious Fake Router Pre-Deployed 2023-02-20 · $2M · Insider Exit Scam — Malicious Fake Router Pre-Deployed · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes (Tomb fork / algorithmic stablecoin template)]
causal dForce Network — Read-Only Reentrancy (Curve wstETH/ETH LP Oracle Manipulation) 2023-02-13 · $4M · Read-Only Reentrancy (Curve wstETH/ETH LP Oracle Manipulation) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Compound fork (dForce lending is Compound-inspired)]
causal Midas Capital — Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation 2023-01-15 · $660K · Read-only reentrancy on Curve LP token virtual price — inflated collateral valuation · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Compound V2 / Fuse fork architecture]
causal Lodestar Finance — Oracle Price Manipulation (LP Token Donation) 2022-12-10 · $7M · Oracle Price Manipulation (LP Token Donation) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Compound fork]
causal Moola Markets — Price Manipulation (Native Token Collateral) 2022-10-19 · $8M · Price Manipulation (Native Token Collateral) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Aave fork (Celo deployment)]
causal TempleDAO / STAX Finance — Missing access control in migrateStake() — unvalidated oldStaking parameter 2022-10-11 · $2M · Missing access control in migrateStake() — unvalidated oldStaking parameter · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: No — TempleDAO was an OHM-fork that had pivoted to FRAX stablecoin farming; STAX was original code]
causal Sovryn — External call reentrancy via callTokensToSend — token price inflation via mid-transaction mint → overclaim via burn 2022-10-04 · $1M · External call reentrancy via callTokensToSend — token price inflation via mid-transaction mint → overclaim via burn · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — lending pool design influenced by Compound/Aave patterns adapted for RSK] || Is-a-fork-of (BTC-DeFi taxonomy partial — see PD-032) [via cross-hack: Factor 44: Bitcoin L2 / Sidechain Legacy Code Without Standard Security Patterns]
causal Gym Network (GymNet) — Missing caller verification — fake deposits via unchecked balance inflation → withdraw drain 2022-06-10 · $2M · Missing caller verification — fake deposits via unchecked balance inflation → withdraw drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — built on top of Alpaca Finance (yield strategy layer)]
causal Fortress Protocol (lending arm of JetFuel Finance) — Oracle Manipulation + Malicious Governance Proposal 2022-05-09 · $3M · Oracle Manipulation + Malicious Governance Proposal · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — JetFuel Finance / Compound-style lending fork on BSC]
causal Mad Meerkat Finance (MM.Finance) — DNS Hijack / Front-End Attack (Router Address Substitution) 2022-05-04 · $2M · DNS Hijack / Front-End Attack (Router Address Substitution) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Cronos DEX fork (Uniswap V2-style)]
causal Saddle Finance — Flash Loan + LP Token Price Manipulation (Old MetaSwapUtils Library) 2022-05-01 · $11M · Flash Loan + LP Token Price Manipulation (Old MetaSwapUtils Library) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Curve Finance fork (extensively)]
causal Fei Protocol / Rari Capital (Fuse) — Re-entrancy via `exitMarket()` in Compound fork missing check-effects-interaction pattern 2022-04-30 · $80M · Re-entrancy via `exitMarket()` in Compound fork missing check-effects-interaction pattern · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Compound Finance fork (Fuse uses modified Compound codebase)]
causal Deus DAO — Dual oracle manipulation — VWAP oracle pre-poisoned via flash swap, then on-chain AMM oracle manipulated via flash loan — to inflate DEI collateral value and borrow far beyond real collateral worth 2022-04-28 · $13M · Dual oracle manipulation — VWAP oracle pre-poisoned via flash swap, then on-chain AMM oracle manipulated via flash loan — to inflate DEI collateral value and borrow far beyond real collateral worth · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked: No specific fork origin noted]
causal Voltage Finance / Ola Finance — ERC677 callAfterTransfer() reentrancy in Compound fork — borrow before balance update 2022-03-31 · $4M · ERC677 callAfterTransfer() reentrancy in Compound fork — borrow before balance update · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Compound fork (via Ola Finance "Compound-like instance" architecture)]
causal Cashio — Infinite mint via incomplete collateral validation — fake account chain bypasses all verification 2022-03-23 · $48M · Infinite mint via incomplete collateral validation — fake account chain bypasses all verification · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked: Unknown — novel Solana stablecoin design, not a direct fork of Ethereum equivalents]
causal Agave DAO + Hundred Finance (dual attack) — ERC677 callAfterTransfer() reentrancy — flash loan collateral → nested borrow calls before debt balance update → multi-asset drain 2022-03-15 · $12M · ERC677 callAfterTransfer() reentrancy — flash loan collateral → nested borrow calls before debt balance update → multi-asset drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — both are forks (Aave V2 and Compound respectively)]
causal Meter (Passport Bridge) — Deposit method calldata bypass — unwrapped native token assumption not enforced in secondary deposit path 2022-02-05 · $8M · Deposit method calldata bypass — unwrapped native token assumption not enforced in secondary deposit path · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — ChainSafe ChainBridge fork with custom modifications]
causal Qubit Finance — Zero-Address safeTransferFrom Logic Bug (Cross-Chain Bridge Deposit) 2022-01-28 · $80M · Zero-Address safeTransferFrom Logic Bug (Cross-Chain Bridge Deposit) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — BSC lending protocol; Compound-adjacent architecture]
causal Arbix Finance — Insider rug pull — deployer drained user vaults and disappeared, then dumped native token via PancakeSwap 2022-01-04 · $10M · Insider rug pull — deployer drained user vaults and disappeared, then dumped native token via PancakeSwap · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — common BSC yield aggregator fork pattern]
causal Grim Finance — Reentrancy 2021-12-18 · $30M · Reentrancy · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Beefy Finance fork]
causal 8ight Finance — Admin key compromise — private key shared via Facebook chat and Google Drive → treasury drain 2021-12-07 · $2M · Admin key compromise — private key shared via Facebook chat and Google Drive → treasury drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Olympus DAO fork]
causal Snowdog (SnowdogDAO) — Insider front-running — privileged challengeKey knowledge + custom AMM sniping 2021-11-25 · $21M · Insider front-running — privileged challengeKey knowledge + custom AMM sniping · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — OHM fork (Snowbank); custom AMM forked from Uniswap V2]
causal Indexed Finance — Flash Loan — Rebalancing Delay Pool Oracle Manipulation 2021-10-14 · $16M · Flash Loan — Rebalancing Delay Pool Oracle Manipulation · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes (Balancer BPool fork with custom rebalancing logic)]
causal Cream Finance — ERC-777 Reentrancy (Token Integration Vulnerability) 2021-08-30 · $19M · ERC-777 Reentrancy (Token Integration Vulnerability) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Cream Finance is a fork of Compound Finance]
causal Cream Finance — ERC777 reentrancy via newly integrated AMP token — reentrant `borrow()` before state update 2021-08-30 · $19M · ERC777 reentrancy via newly integrated AMP token — reentrant `borrow()` before state update · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked: Compound V2 fork]
causal Punk Protocol — Unprotected initialize() — delegateCall Forge Address Override 2021-08-10 · $9M · Unprotected initialize() — delegateCall Forge Address Override · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — built on Compound infrastructure]
causal PancakeBunny (Polygon deployment — polyBUNNY) — Flash Loan + Reward Minting Manipulation (Performance Fee Inflation) 2021-07-18 · $2M · Flash Loan + Reward Minting Manipulation (Performance Fee Inflation) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Polygon deploy is essentially same codebase as BSC]
causal Merlin Labs (REKT 3) — Reward Minting Manipulation (Balance Inflation) 2021-06-29 · $330K · Reward Minting Manipulation (Balance Inflation) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — PancakeBunny fork]
causal SafeDollar — Infinite Mint via Fee-on-Transfer Reward Accounting Bug 2021-06-28 · $248K · Infinite Mint via Fee-on-Transfer Reward Accounting Bug · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — fork of algorithmic stablecoin model (Basis/ESD family)]
causal StableMagnet — Malicious Unverified Library (SwapUtils) — Rugpull with Approval Drain 2021-06-24 · $27M · Malicious Unverified Library (SwapUtils) — Rugpull with Approval Drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Curve/Saddle stableswap fork]
causal Eleven Finance (11) — emergencyBurn() missing balance accounting — ghost withdrawal double-spend 2021-06-14 · $5M · emergencyBurn() missing balance accounting — ghost withdrawal double-spend · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — forked from PancakeBunny / standard BSC yield aggregator pattern]
causal AutoShark Finance — Flash loan + SharkMinter balance spoofing → excess native token minting 2021-06-01 · $745K · Flash loan + SharkMinter balance spoofing → excess native token minting · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — direct fork of PancakeBunny (which had been exploited 8 hours earlier by the same vector)]
causal Levyathan Finance — Exposed Private Key + Minting + emergencyWithdraw Bug 2021-06-01 · $2M · Exposed Private Key + Minting + emergencyWithdraw Bug · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — generic yield farm fork (MasterChef style)]
causal Belt Finance — Flash Loan + Price/Share Manipulation (Incorrect Share Valuation) 2021-05-29 · $6M · Flash Loan + Price/Share Manipulation (Incorrect Share Valuation) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — described as "fork of a fork"]
causal BurgerSwap — Reentrancy via non-standard BEP-20 + missing x*y=k invariant check 2021-05-28 · $7M · Reentrancy via non-standard BEP-20 + missing x*y=k invariant check · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — Uniswap V2 fork with the x*y≥k invariant check deliberately or accidentally removed]
causal Merlin Labs (REKT 2) — Oracle Mispricing 2021-05-27 · $550K · Oracle Mispricing · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — PancakeBunny fork]
causal Merlin Labs — External token balance spoofing → excess native token minting 2021-05-26 · $680K · External token balance spoofing → excess native token minting · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Yes — PancakeBunny fork]
causal PancakeBunny — Flash loan + spot price manipulation → inflated LP token valuation → excess BUNNY minting 2021-05-19 · $45M · Flash loan + spot price manipulation → inflated LP token valuation → excess BUNNY minting · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — BSC yield aggregator forking concepts from Yearn and Bunny-style vaults]
causal bEarnFi (BvaultsBank) — Logic bug — token denomination mismatch between vault and strategy layers 2021-05-16 · $18M · Logic bug — token denomination mismatch between vault and strategy layers · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked: Y — described as "copied code" from other BSC protocols; typical BSC fork pattern]
causal Value DeFi — Bancor Power Function Misuse (Weighted AMM Invariant Bypass) 2021-05-08 · $11M · Bancor Power Function Misuse (Weighted AMM Invariant Bypass) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Bancor formula adapted; Uniswap V2 base with weighted pool extension]
causal Value DeFi — Uninitialized Pool Re-initialization (Missing initialized = true) 2021-05-05 · $10M · Uninitialized Pool Re-initialization (Missing initialized = true) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — code migrated/forked from own earlier implementation]
causal Uranium Finance — Math bug — constant product formula check broken by inconsistent parameter change (1000→10000) 2021-04-28 · $57M · Math bug — constant product formula check broken by inconsistent parameter change (1000→10000) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Uniswap V2 fork on BSC]
causal EasyFi (Easy Network) — Admin key theft via compromised machine (malicious MetaMask binary) 2021-04-19 · $59M · Admin key theft via compromised machine (malicious MetaMask binary) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Compound Finance fork]
causal BT Finance + Growth DeFi (two separate hacks, one article) — BT Finance: Flash Loan Price Manipulation; Growth DeFi: Fake Token LP Injection 2021-02-09 · $2M · BT Finance: Flash Loan Price Manipulation; Growth DeFi: Fake Token LP Injection · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — both are yield aggregator forks of common patterns]
causal Compounder Finance — Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull) 2020-12-02 · $12M · Malicious Strategy Contracts — Backdoor Withdrawal (Insider Rug Pull) · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Yearn Finance fork (yield aggregator architecture with Vaults, Strategies, and StrategyController)]
causal Pickle Finance — Fake jar injection — missing whitelist in Controller's jar-swap function 2020-11-22 · $20M · Fake jar injection — missing whitelist in Controller's jar-swap function · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — Pickle Jars are a fork of Yearn's yVaults]
causal Harvest Finance — Flash loan + Curve Y-pool spot price manipulation → inflated fToken share valuation → vault drain 2020-10-26 · $34M · Flash loan + Curve Y-pool spot price manipulation → inflated fToken share valuation → vault drain · Is-a-fork-of (Cat 8 anchor) [via dashboard_risk_factors/Forked?: Y — inspired by Yearn Finance vault architecture]
rubric_version v1.7.0 factor RD-F-126 category 8 carried 0 critical no