DeFi Hacks Reproduce - Foundry

Reproduce DeFi hack incidents using Foundry.

871 incidents included.

Let's make Web3 secure! Join Discord

Notion: 101 root cause analysis of past DeFi hacked incidents

Disclaimer: This content serves solely as a proof of concept showcasing past DeFi hacking incidents. It is strictly intended for educational purposes and should not be interpreted as encouraging or endorsing any form of illegal activities or actual hacking attempts. The provided information is for informational and learning purposes only, and any actions taken based on this content are solely the responsibility of the individual. The usage of this information should adhere to applicable laws, regulations, and ethical standards.

Getting Started
Who Support Us
Donate Us
List of Past DeFi Incidents
Transaction debugging tools
Ethereum Signature Database
Useful tools
Hacks Dashboard
List of DeFi Hacks & POCs

DeFiHackLabs

Populaires

DeFi Hacks Reproduce - Foundry

Table of Contents

Getting Started

Web3 Cybersecurity Academy

OnChain transaction debugging

Donate us

List of Past DeFi Incidents

Transaction debugging tools

Ethereum Signature Database

Useful tools

Hacks Dashboard

List of DeFi Hacks & POCs

20260905 DHC - repeatable claim due to missing claimed-flag

Lost: ~$71.8K USDT

Contract

20260903 NotionalFinance - ERC1155 fCash mint overflow drains escrow

Lost: ~69,257.37 DAI + 1,658,524.86 USDC ($1.73M)

Contract

20260901 ReflexerGEB - Shared GebProxyActions library registered as SAFE owner

Lost: 5.9436 ETH ($14K, drained from 4 SAFEs in one tx: IDs 3, 5, 8, 18)

Contract

20260831 AnkrMORE - Certificate over-mint via bond-ratio staking drained through MORE E-mode

Lost: 15,488,124 WFLOW drained from the MORE Markets reserve ($410K); attack contract kept ~9,819,641 FLOW

Contract

20260831 BalancerV1BPool - joinswapPoolAmountOut rounding drain across 5 pools

Lost: $234K reported aggregate across 5 separate Balancer V1 pools, one drain per tx; this PoC reproduces the DPI/USDC/WETH/WBTC pool instance ($110,839, exact)

Contract

20260831 FloatProtocol - Uniswap V3 spot-price manipulation of Hypervisor LP shares

Lost: 10.7066 ETH ($28K)

Contract

20260830 TectonicTONIC - Mango Markets-style collateral price manipulation of TONIC

Lost: ~$66-75M reported, every liquid Tectonic market drained in one tx (USDC $55.24M, USDT $45.65M, WBTC 98, CDCBTC 32.9, WETH 1895, CDCETH 379.7, XRP 270.6K, LCRO 26.2M) — Cronos EVM chain halted in response

Contract

20260828 AjnaFinance - Liquidation accounting manipulation via self-controlled auction

Lost: ~$775K across 7 pools total; this PoC reproduces the cbETH pool instance (~43.75 cbETH + ~1.5 WETH, ~$124.8K)

Contract

20260827 MoonwellMAMO - Chainlink oracle-source price manipulation of MAMO collateral

Lost: 71.36 cbBTC total across 12 repeated borrows ($5.7M); this PoC reproduces the largest single instance, 14.34 cbBTC ($1.15M)

Contract

20260827 CashCowCoin - Privileged burn + sync() drains pair reserve via iterative sells

Lost: 165.47 WBNB ($117.4K, drained across 80 iterative sell cycles in one tx)

Contract

20260825 EnjinCryptoItems - Unprotected registry reinitialization -> manager takeover

Lost: ~5.24M ENJ (attacker +5,231,353 ENJ, reserve -5,238,353 ENJ)

Contract

20260825 FHToken - Sell-tax reserve mismatch via premature sync()

Lost: 19,999.02 USDT ($20K)

Contract

20260823 TermFinance - TermMax meta-vault flashloan logic exploit

Lost: ~2,841.74 WETH + 1,679,639 USDC ($8.5M combined, two independent flashloan-funded drains)

Contract

20260823 ArrakisGUNI - Uniswap V3 spot-price manipulation of vault mint/burn

Lost: ~2.9414 ETH net attacker surplus (Arrakis V1 / G-UNI ENS-WETH vault)

Contract

20260822 SandboxOFT - LayerZero delegate hijack via approveAndCall

Lost: 10,000,000 SAND minted unbacked (~$517,170 face value, one of 400+ repeated txs in an ongoing campaign)

Contract

20260820 FlashstakeV2 - Mispriced reward pool, instant upfront reward extraction

Lost: ~0.5453 WETH drained (28.25% of reward pool reserve); attacker net profit ~0.4285 ETH

Contract

20260819 AllbridgeCCTP - Phantom CCTP deposit via unverified message attestation

Lost: ~190,155.98 USDC drained (net attacker profit ~189,751.55 USDC after flash-loan premium; router retained its 1,000 USDC fee)

Contract

20260815 FoxLpBondsPool - Stale _stakeAmount from manipulable AMM spot quote

Lost: 112,976.12 USDC ($118.7K reported)

Contract

20260809 USM - defund() price split-invariance rounding exploit

Lost: ~70.83 ETH

Contract

20260807 Atomic - Flash-loan price oracle manipulation of lending collateral valuation

Lost: ~29,984.27 USDC

Contract

20260806 UnistreetLaunchpad - Arbitrary call injection via unvalidated launch forwarding

Lost: ~$17,743.91 USDC + ~0.0072 WETH (plus 9 illiquid launch memecoin positions)

Contract

20260806 PantherBase - Reality.eth governance timeout exploit (pre-production Base deployment, no user funds)

Lost: 5,124,773.63 ZKP + 0.1233 ETH (Panther Base pre-launch deployment, not live user funds)

Contract