Synthetics Implemented Right @leveragesir has been hacked for $355k
This is a clever attack. In the vulnerable contract Vault (etherscan.io/address/0xb91a…) there is a uniswapV3SwapCallback function that uses transient storage to verify the caller. Specifically, it loads an address
Decurity
345 posts
DeFi Security | Tier-1 Security Audit Firm | Top-2 in @Paradigm and @OpenZeppelin CTF | Public audits: github.com/Decurity/audits
Joined October 2011
- This is a story about how we found a critical vulnerability in @dxsale, helped rescuing more than $5 million, and got offered a $500 bounty.
- Releasing our new IDA Pro plugin for analyzing Solana's eBPF programs developed by @dewardgnome. Check out the blog post:
- We analyzed the smart contract hacks from 2020 to 2025 to answer the question: how fast the vulnerable smart contracts get exploited after the deployment? Read the research: time-to-hack.decurity.io
- Li.Fi bridge was exploited for ~8M USD. The root cause is a possibility of an arbitrary call with user controlled data via `depositToGasZipERC20()` in GasZipFacet which was deployed 5 days ago! One of hack txs: defimon.xyz/attack/mainnet…
- pETH belonging to @JPEGd_69 has just been exploited for 11 million USD with a Curve read only reentrancy. An attacker was frontrunned by a MEV-bot: etherscan.io/tx/0xa84aa065c… A screenshot from our monitoring system:
- 🔬New tool for onchain bug hunters: github.com/Decurity/tx-co… tx-coverage allows to reveal unused code of live smart contracts by collecting coverage from historical transactions. With it you can discover code that was never executed onchain and may contain potential bugs.
- c0ffeebabe.eth executed a front-run hack for 1.9k $ on pbtc-sbtc-f Curve pool compiled with vulnerable Vyper 0.2.15: etherscan.io/tx/0xe928d5de5… This time a reentrancy was possible due to a ERC-777 callback in sBTC instead of a fallback on eth transfer.
- Defimon.xyz alerts are now public! Join t.me/defimon_alerts to learn about DeFi incidents in real-time. For bug bounty hunters we indexed all smart contracts from @immunefi to notify about: ~ Proxy Upgrades ~ Access Control Changes ~ Governance Activity and more
- Looks like Tornado Governance got eventually exploited:Possible governance attack (?) underway at TORN. Someone creating hundreds of contracts atomically and then passing zero TORN transfers through before transferring on to gov vault, very weird activity.
- Our audit reports for the @1inch Fusion contracts are out now! During development and testing, the 1inch contributors' team has resolved the following issues reported by us: ✅ 3 high severity bugs ✅ 1 medium severity bug ✅ 7 low ✅ 16 info Check it out: github.com/Decurity/audit…









