Case research

Source-level Web3 incident research.

Each case reconstructs the vulnerability from primary sources: the root cause, a line-by-line read of the key code, and the full attack chain step by step.

DeFi Exploits

EIP-7702 Flashloan-Protection Bypass Case Research: When tx.origin == msg.sender Stopped Meaning EOA

2025-08-24

A source-level and on-chain reconstruction of one of the first EIP-7702 exploits: a delegated EOA that defeats the classic flashloan guard, manipulates a PancakeSwap spot price, and inflates a staking position on BSC.

EIP-7702FlashloanOracle ManipulationBSCPectra2025

DeFi Exploits

GMX V1 $42M Case Research: Reentrancy and the Split-Brain Short Accounting That Forged a GLP Price

2025-07-09

A source-level and on-chain reconstruction of the GMX V1 GLP exploit: the keeper-mediated reentrancy door, the desynced global-short accounting between Vault and ShortsTracker, and the transaction that minted GLP cheap and redeemed it inflated.

GMXReentrancyGLPArbitrumAUM Manipulation2025

DeFi Exploits

Cork $12M Case Research: HIYA Price Skew Meets an Unauthenticated Uniswap v4 Hook

2025-05-28

A source-level reconstruction of the Cork Protocol exploit: near-expiry HIYA manipulation, unauthenticated CorkHook.beforeSwap calls, fake market setup, and derivative redemption into wstETH.

CorkUniswap v4HookAccess ControlOracle ManipulationwstETH2025

DeFi Exploits

Cetus $223M Case Research: The CLMM Shift Check That Minted Liquidity for One Unit

2025-05-22

A source-level reconstruction of the Cetus Sui CLMM exploit: a flawed u256 left-shift overflow check, undercharged add-liquidity math, and the remove-liquidity path that pulled real reserves out.

CetusSuiMoveCLMMFixed-Point MathFlashloan2025

Operational Security

ZKsync $5M Case Research: Airdrop Admin Compromise and the sweepUnclaimed Mint

2025-04-15

A reconstruction of the ZKsync airdrop incident: a compromised admin account, sweepUnclaimed-driven minting of 111M ZK, exchange liquidation pressure, and negotiated fund recovery.

ZKsyncAirdropPrivate Key CompromiseAccess ControlMintZK2025

DeFi Exploits

KiloEx $7.5M Case Research: A Trusted Forwarder That Let Anyone Become the Price Keeper

2025-04-14

A source-level reconstruction of the KiloEx multi-chain exploit: a MinimalForwarder trust-boundary failure, forged keeper calls, direct setPrices control, and leveraged oracle profit extraction.

KiloExOracle ManipulationAccess ControlForwarderPerpsBaseBNB Chain2025

Operational Security

UPCX $70M Case Research: When a ProxyAdmin Key Became the Protocol

2025-04-01

A source-level and control-plane reconstruction of the UPCX exploit: a compromised privileged key, malicious ProxyAdmin upgrade, withdrawByAdmin execution, and treasury-scale token drain.

UPCXPrivate Key CompromiseProxyAdminAccess ControlUpgradeable ProxyEthereum2025

Exchange Incidents

Bybit $1.46B Case Research: Tracing the Safe{Wallet} delegatecall Takeover

2025-02-22

A source-level and on-chain reconstruction of the Bybit cold-wallet heist: the tampered Safe{Wallet} JavaScript, the delegatecall storage overwrite, and the full transaction trail.

BybitSafe{Wallet}delegatecallLazarusSupply Chain2025