Reproduce DeFi hack incidents using Foundry.
558 incidents included.
Let's make Web3 secure! Join Discord
Notion: 101 root cause analysis of past DeFi hacked incidents
Disclaimer: This content serves solely as a proof of concept showcasing past DeFi hacking incidents. It is strictly intended for educational purposes and should not be interpreted as encouraging or endorsing any form of illegal activities or actual hacking attempts. The provided information is for informational and learning purposes only, and any actions taken based on this content are solely the responsibility of the individual. The usage of this information should adhere to applicable laws, regulations, and ethical standards.
-
Follow the instructions to install Foundry.
-
Clone and install dependencies:
git submodule update --init --recursive
All articles are also published on Substack.
- Lesson 1: Tools ( English | 中文 | Vietnamese | Korean | Spanish )
- Lesson 2: Warm up ( English | 中文 | Korean | Spanish )
- Lesson 3: Write Your Own PoC (Price Oracle Manipulation) ( English | 中文 | Korean | Spanish )
- Lesson 4: Write Your Own PoC (MEV Bot) ( English | 中文 | Korean | Spanish )
- Lesson 5: Rugpull Analysis ( English | 中文 | Spanish )
- Lesson 6: Write Your Own PoC (Reentrancy) ( English | 中文 | Spanish )
- Lesson 7: Hack Analysis: Nomad Bridge, August 2022 ( English | 中文 | Spanish )
If you appreciate our work, please consider donating. Even a small amount helps us continue developing and improving our projects, and promoting web3 security.
- Gitcoin - Donate DeFiHackLabs
- EVM Chains - 0xD7d6215b4EF4b9B5f40baea48F41047Eb67a11D5
- Giveth
2024
20240703 UnverifiedContr_0x452E25
20240610 UwuLend - Price Manipulation
2023
20231201 UnverifiedContr_0x431abb
20230715 USDTStakingContract28
2022
20221024 MulticallWithoutCheck
20221011 Rabby Wallet SwapRouter
20220908 Ragnarok Online Invasion
20220701 Quixotic - Optimism NFT Marketplace
20220624 Harmony's Horizon Bridge
20220608 Optimism - Wintermute
20220430 Rari Capital/Fei Protocol
2021
Before 2020
Phalcon | Tx tracer | Cruise | Ethtx | Tenderly | eigenphi
ABI to interface | Get ABI for unverified contracts | ETH Calldata Decoder | ETHCMD - Guess ABI | Abi tools
Slowmist | Defillama | De.Fi | Rekt | Cryptosec | BlockSec
forge test --contracts ./src/test/2025-02/Bybit_exp.sol -vvvhttps://x.com/dhkleung/status/1893073663391604753
forge test --contracts ./src/test/2025-02/FourMeme_exp.sol -vvv --evm-version shanghaihttps://www.chaincatcher.com/en/article/2167296
forge test --contracts ./src/test/2025-01/ODOS_exp.sol -vvvforge test --contracts ./src/test/2025-01/Ast_exp.sol -vvvforge test --contracts ./src/test/2025-01/Paribus_exp.sol -vvvforge test --contracts ./src/test/2025-01/Mosca2_exp.sol -vvv --evm-version shanghaihttps://x.com/TenArmorAlert/status/1878699517450883407
forge test --contracts ./src/test/2025-01/RoulettePotV2_exp.sol -vvv --evm-version shanghaihttps://x.com/TenArmorAlert/status/1878008055717376068
forge test --contracts ./src/test/2025-01/JPulsepot_exp.sol -vvv --evm-version shanghaihttps://x.com/CertiKAlert/status/1877662352834793639
forge test --contracts ./src/test/2025-01/LPMine.sol -vvv --evm-version cancunhttps://x.com/TenArmorAlert/status/1877030261067571234
forge test --contracts ./src/test/2025-01/IPC_exp.sol -vvv --evm-version cancunhttps://x.com/TenArmorAlert/status/1876663900663370056
forge test --contracts ./src/test/2025-01/Mosca_exp.sol -vvv --evm-version shanghaihttps://x.com/0xNickLFranklin/status/1876884383736430821
forge test --contracts ./src/test/2025-01/sorraStaking.sol -vv --evm-version cancunhttps://x.com/TenArmorAlert/status/1875582709512188394
forge test --contracts ./src/test/2025-01/98Token_exp.sol -vvvv --evm-version cancunhttps://x.com/TenArmorAlert/status/1875462686353363435
forge test --contracts ./src/test/2025-01/LAURAToken_exp.sol -vvvhttps://x.com/TenArmorAlert/status/1874455664187023752
Foundry also has the ability to report the gas used per function call which mimics the behavior of hardhat-gas-reporter. Generally speaking if gas costs per function call is very high, then the likelihood of its success is reduced. Gas optimization is an important activity done by smart contract developers.
Every poc in this repository can produce a gas report like this:
forge test --gas-report --contracts <contract> -vvvFor Example: Let us find out the gas used in the Audius poc
Execution
forge test --gas-report --contracts ./src/test/Audius.exp.sol -vvvDemo
Moved to DeFiVulnLabs
Moved to DeFiLabs
