app.blocksec.com/explorer/tx/et… An old lending defi hacked. Root cause is old oracle that hasn't updated for a long time. In hacking, he transferred some tokens into cToken because of borrow rate.

app.blocksec.com/explorer/tx/et…. Victim contract doesn't check if msg.sender is valid in "uniswapV3Callback" function.

etherscan.io/tx/0x9faeb52a9…. MUSKITO token hacked? Root cause is in "burn()" function. "burn()" function decreases balance of uniswap pair. To bypass first line, he bought 1 wei of token hundreds of time, and then called "burn()" function. Hacker gained $900. 😁

app.blocksec.com/explorer/tx/bs… HFLH exploit. Root cause is in price calcualtion. As you can see, price is calculated by amount of tokens in LP, but this can be maniupulated easily. Hacker could manipulate this price by transfering tokens into LP,after that he used "skim" to get tokens.

app.blocksec.com/explorer/tx/et…. Reentrancy attack! There's no reenctrance check in code.

I decided to launch my own Defi, what kind of Defi will be the best? DEX, Lending or Staking? If anyone has good opinion, please send me message.

Which lending project do users like better? Aave or Compound?

app.blocksec.com/explorer/tx/et…. An unverified contract lost $4k. I think root cause is improper check of calldata in "uniswapV2Call" function. It needs to check first parameter-sender address, but it didn't. Hacker could call this callback function by calling "swap" function.

I just created a personal site for defi hacking analysis reports. I hope it will be helpful to everyone. If you have any good ideas to improve the site, please let me know. nickfranklin.site

Reentrancy attack. nickfranklin.site/2024/09/04/pen…

Finally, I decided to launch new Lending Defi-"AquaLoan". Will be deployed soon.

CUT token hacked, lost $1.4m. nickfranklin.site/2024/09/10/cut…

OTSea Staking hacked. nickfranklin.site/2024/09/13/ots…

app.blocksec.com/explorer/tx/ba…. Private key leak or rug pull? basescan.org/tx/0x05b327ada…

Yeah, hacker changed admin and then upgraded proxy. x.com/cyversalerts/s…

WXETA token exploit. nickfranklin.site/2024/09/17/wxe…