Smart Contract & Protocol Exploits

A protocol exploit is rarely a bug in the romantic sense. It is a contract executing its stated rules against an input nobody modelled — a price that can be moved, a sponsor that pays for anything, a delegation that outlives its purpose.

How this vector actually works

The cases below share a structure: an assumption written into code, an attacker who reads code better than the reviewers did, and a window measured in blocks. Two of them are repeat incidents, which is its own lesson about remediation.

  • The assumption — A price feed is trusted, a caller is trusted, a gas sponsor is unlimited. The assumption is invisible because it was never written down as one.
  • The manipulation — Flash-borrowed capital, a crafted call sequence, or a delegated account turns the assumption false for exactly one block.
  • The repeat — The patch addresses the symptom. The class of bug stays, and the same protocol is hit again weeks later.

Red flags you can check in a minute

Any single item below is enough to stop and verify before you sign, send or install anything. The contract worked perfectly. That was the problem.

  • A single price source, or an oracle with thin liquidity behind it.
  • Gas sponsorship or fee abstraction without per-user limits.
  • Audit scope that excludes the module handling the money.
  • A previous incident whose post-mortem promised process changes rather than code changes.
  • Admin functions reachable without a timelock.

If it already happened

Order matters more than speed of panic: contain the wallet first, preserve the evidence second, report third. Recovery services that contact you after the fact are the follow-up scam.

  • Withdraw from the affected pools before secondary liquidations cascade.
  • Revoke approvals to the exploited contract, including any router in front of it.
  • Record your position at the incident block; reimbursements are settled from a snapshot.
  • Read the post-mortem for the bug class, not the patch — the class predicts the next incident.

Related vectors and tools

Most real cases mix two vectors, so read the neighbouring hubs, and run anything suspicious through the detector before you act on it.