2025
EVM Smart Contract Exploit Analysis

This report evaluates 2025’s EVM exploit landscape through one high-stakes question, did the vulnerable logic exist before deployment, and could a team have proven it unsafe earlier. Across the dataset, losses concentrate into repeatable logic and invariant failures, and the majority of incidents fall into detectable classes that can be surfaced with deterministic testing, not post-hoc forensics.

Snapshot, the numbers behind 2025’s onchain failures:

• 50 EVM smart contract exploits reviewed (Solidity, onchain logic failures).
• 49 exploits considered preventable prior to deployment with deterministic testing.
• 98% of incidents fell within detectable vulnerability classes, only one was outside scope.
• ~$240M approximate total losses classified as preventable in the in-scope set.
• $121.1M largest single breakdown (Balancer), driven by precision and rounding bias in accounting logic.
• Logic was the dominant failure class by count (valid calls, the protocol behaved as written).