Web3Exploit logoWeb3Exploit
← Back to Learn
Learn · Attack patterns

Vulnerability classes, taught through real cases.

Each explainer walks the root cause, a vulnerable-vs-fixed code pair, and a defensive checklist — then links back to the documented incidents where it played out.

Reentrancy
An external call hands control to an attacker before state is finalized, letting them re-enter and act on stale storage.
Oracle Manipulation
A protocol prices assets off a manipulable source (spot AMM reserves or desynced internal state), letting an attacker forge a favorable price.
Flash Loan Attack
Uncollateralized, single-transaction capital amplifies another bug — usually oracle manipulation or governance — to profitable scale.
Access Control
A privileged action is reachable by the wrong caller because a check is missing, wrong, or built on a broken assumption.
Signature Verification
What is signed or verified diverges from what actually executes — via delegatecall storage overwrite, malleability, or blind signing.
Bridge Exploits
Cross-chain bridges concentrate value and trust; a flawed message-verification or signer set lets an attacker forge withdrawals.
Private Key Compromise
Keys or signing devices are stolen or tricked into signing, so on-chain actions are fully valid yet unauthorized.