These four exploits showcase the full spectrum of DeFi negligence: Pawnfi let attackers borrow against NFTs they didn’t own. Midas got drained by a one-wei rounding error. Hashflow shipped token transfers with zero authorization. And Ara let flash-loan attackers dictate price with unchecked swaps. The shared thread? Logic that assumes trust where there should be verification , and price that assumes stability where there should be bounds.
On June 19, the Ara exploit on the BNB chain caused a loss of $125K. The attacker initially borrowed 1.2M USDT and manipulated the price of ARA tokens by performing a large swap of approximately 680K ARA tokens. This allowed the attacker to swap overpriced ARA tokens for USDT and make a profit after repaying the flash loan. The lack of limits and authorization on ARA-USDT swaps enabled the attacker to execute these large swaps.
Exploit Contract (on BNB Chain): 0x7BA5dd9Bb357aFa2231446198c75baC17CEfCda9
Transaction Hash: 0xd87cdecd5320301bf9a985cc17f6944e7e7c1fbb471c80076ef2d031cc3023b2
On June 18, the Midas Capital exploit on the BNB chain resulted in a $600K loss due to a rounding issue. The attacker utilized flash loans and donated LP and ANKR tokens to Midas Capital’s lending contract, which is a fork of Compound Finance’s CErc20 contract. They minted and supplied 21,184 LP tokens, redeeming all but 1001 wei of cTokens. By donating 259,826.61 HAY/BUSD LP tokens to the exploit contract, the attacker inflated the exchange rate to nearly 1,001 wei cTokens equaling $519K. Exploiting this inflated rate, they withdrew 519 LP tokens with 1 wei of underlying assets. 519 of 259,826 LP tokens is 0.1998% of the total supply but the exploit contract rounded it to 1 wei of the total 1001 wei instead of 2 wei. The attacker eventually repaid the flash loans and made a profit of $600K.
Decompiled Exploit Contract (on BNB Chain): 0xf8527dc5611b589cbb365acacaac0d1dc70b25cb
Transaction Hash: 0x1ebc03f0f2257c275f4990b4130e6c3e451125aa98ee8bbde8aba5dc0320c659
On June 17, the Pawnfi exploit resulted in a loss of $820K due to a borrowing logic vulnerability. Pawnfi’s ApeStaking contract allows users to use NFTs as collateral for borrowing, but it doesn’t verify if the NFT is actually transferred. Exploiting this vulnerability, the attacker invoked the depositAndBorrowApeAndStake() function to borrow APE tokens using an NFT that was already staked in the APE Staking Pool. The attacker then withdrew the APE tokens, making a profit.
Exploit Contract: 0x85018CF6F53c8bbD03c3137E71F4FCa226cDa92C
Transaction Hash: 0xe855cc3bad87933bf742fd474bd0ae0ec58d45e9c1a0643b9700dafe8faf0864
On June 14, the Hasflow exploit on multiple chains resulted in a $600K loss. The lack of authorization checks during token transfers was the main cause of the exploit. The exploit contract’s private 0x1ce5() function had a transferFrom() function that enabled token transfers by any user. The attacker, who is believed to be a white-hat hacker, allowed affected users to recover the stolen assets. The Hashflow team announced that all affected users would be reimbursed.
Decompiled Exploit Contract: 0x79cdfd7bc46d577b95ed92bcdc8ababa1844af0c
Transaction Hash: 0xdedda493272b6b35660b9cc9070d2ea32ee61279b821184ff837e0a5752f4042