Web3Exploit logoWeb3Exploit
Case researchAttack patternsSource-level analysis

Curated Web3 exploit research for builders and security teams.

Web3Exploit focuses on source-level case research for Web3 incidents: what failed, where the trust boundary lived, and which code paths deserve deeper review. Less manual archive work, more reusable engineering signal.

Explore case researchStart learning →
Research cases
8
Featured research
01EIP-7702 Flashloan-Protection Bypass Case Research: When tx.origin == msg.sender Stopped Meaning EOADeFi Exploits · 2025-08-2402GMX V1 $42M Case Research: Reentrancy and the Split-Brain Short Accounting That Forged a GLP PriceDeFi Exploits · 2025-07-0903Cork $12M Case Research: HIYA Price Skew Meets an Unauthenticated Uniswap v4 HookDeFi Exploits · 2025-05-2804Cetus $223M Case Research: The CLMM Shift Check That Minted Liquidity for One UnitDeFi Exploits · 2025-05-22
Case Research
Source-level incident analysis
Each case reconstructs the vulnerability from primary sources: root cause, key code walkthrough, and the full attack chain.
Tools
Small utilities for review and triage
Focused helpers for decoding, inspecting, and sanity-checking Web3 data during research work.
Learn
Case-driven security learning
Attack-pattern explainers, a Solidity checklist, and a glossary cross-linked to real incidents.
Search
Find research and concepts fast
Search across case research, Learn explainers, checklist items, glossary terms, and tools.
Recent research

Latest source-level case studies.

The list is intentionally small and research-led. Each case links to a full write-up covering the root cause, key code, and attack chain.

DeFi Exploits
EIP-7702 Flashloan-Protection Bypass Case Research: When tx.origin == msg.sender Stopped Meaning EOA
2025-08-24

A source-level and on-chain reconstruction of one of the first EIP-7702 exploits: a delegated EOA that defeats the classic flashloan guard, manipulates a PancakeSwap spot price, and inflates a staking position on BSC.

DeFi Exploits
GMX V1 $42M Case Research: Reentrancy and the Split-Brain Short Accounting That Forged a GLP Price
2025-07-09

A source-level and on-chain reconstruction of the GMX V1 GLP exploit: the keeper-mediated reentrancy door, the desynced global-short accounting between Vault and ShortsTracker, and the transaction that minted GLP cheap and redeemed it inflated.

DeFi Exploits
Cork $12M Case Research: HIYA Price Skew Meets an Unauthenticated Uniswap v4 Hook
2025-05-28

A source-level reconstruction of the Cork Protocol exploit: near-expiry HIYA manipulation, unauthenticated CorkHook.beforeSwap calls, fake market setup, and derivative redemption into wstETH.

DeFi Exploits
Cetus $223M Case Research: The CLMM Shift Check That Minted Liquidity for One Unit
2025-05-22

A source-level reconstruction of the Cetus Sui CLMM exploit: a flawed u256 left-shift overflow check, undercharged add-liquidity math, and the remove-liquidity path that pulled real reserves out.

Operational Security
ZKsync $5M Case Research: Airdrop Admin Compromise and the sweepUnclaimed Mint
2025-04-15

A reconstruction of the ZKsync airdrop incident: a compromised admin account, sweepUnclaimed-driven minting of 111M ZK, exchange liquidation pressure, and negotiated fund recovery.

DeFi Exploits
KiloEx $7.5M Case Research: A Trusted Forwarder That Let Anyone Become the Price Keeper
2025-04-14

A source-level reconstruction of the KiloEx multi-chain exploit: a MinimalForwarder trust-boundary failure, forged keeper calls, direct setPrices control, and leveraged oracle profit extraction.

Operational Security
UPCX $70M Case Research: When a ProxyAdmin Key Became the Protocol
2025-04-01

A source-level and control-plane reconstruction of the UPCX exploit: a compromised privileged key, malicious ProxyAdmin upgrade, withdrawByAdmin execution, and treasury-scale token drain.

Exchange Incidents
Bybit $1.46B Case Research: Tracing the Safe{Wallet} delegatecall Takeover
2025-02-22

A source-level and on-chain reconstruction of the Bybit cold-wallet heist: the tampered Safe{Wallet} JavaScript, the delegatecall storage overwrite, and the full transaction trail.