GitHub - sanbir/evm-hack-poc: A public collection of EVM exploit proof-of-concept (PoC) archives for security research, education, and tooling. These PoCs are generated from evm-hack-registry data and are intended to be used with evm-hack-analyzer.

Branches Tags

Name		Name	Last commit message	Last commit date
Latest commit History 58 Commits
Sorry, we had to truncate this directory to 1,000 files. 516 entries were omitted from the list.
.gitignore		.gitignore
15976-h-03-interest-rates-are-incorrect-on-liquidation-code4rena-p.zip		15976-h-03-interest-rates-are-incorrect-on-liquidation-code4rena-p.zip
15977-h-04-anyone-can-prevent-themselves-from-being-liquidated-as.zip		15977-h-04-anyone-can-prevent-themselves-from-being-liquidated-as.zip
15978-h-05-attacker-can-manipulate-low-tvl-uniswap-v3-pool-to-borr.zip		15978-h-05-attacker-can-manipulate-low-tvl-uniswap-v3-pool-to-borr.zip
15980-h-07-user-can-pass-auction-recovery-health-check-easily-with.zip		15980-h-07-user-can-pass-auction-recovery-health-check-easily-with.zip
15981-h-08-nftfloororacles-asset-and-feeder-structures-can-be-corr.zip		15981-h-08-nftfloororacles-asset-and-feeder-structures-can-be-corr.zip
15982-h-09-uniswapv3-tokens-of-certain-pairs-will-be-wrongly-value.zip		15982-h-09-uniswapv3-tokens-of-certain-pairs-will-be-wrongly-value.zip
15983-h-10-attacker-can-drain-pool-using-executebuywithcredit-with.zip		15983-h-10-attacker-can-drain-pool-using-executebuywithcredit-with.zip
16038-h-01-bond-max-buyer-might-end-up-buying-the-max-buy-of-the-n.zip		16038-h-01-bond-max-buyer-might-end-up-buying-the-max-buy-of-the-n.zip
16039-h-02-attacker-can-front-run-bond-buyer-and-make-them-buy-it.zip		16039-h-02-attacker-can-front-run-bond-buyer-and-make-them-buy-it.zip
16040-h-03-dmutesol-attacker-can-push-lock-items-to-victims-array.zip		16040-h-03-dmutesol-attacker-can-push-lock-items-to-victims-array.zip
16736-aztec-swap-validator-missing-pairing-check.zip		16736-aztec-swap-validator-missing-pairing-check.zip
16739-aztec-confidentialapprove-replay-status.zip		16739-aztec-confidentialapprove-replay-status.zip
16760-setminimumdistribution-not-protected.zip		16760-setminimumdistribution-not-protected.zip
16975-lack-of-contract-existence-check-on-delegatecall-may-lead-to.zip		16975-lack-of-contract-existence-check-on-delegatecall-may-lead-to.zip
16976-use-of-delegatecall-in-a-payable-function-inside-a-loop-trai.zip		16976-use-of-delegatecall-in-a-payable-function-inside-a-loop-trai.zip
16980-yield-v2-witch-buy-payall-no-auction.zip		16980-yield-v2-witch-buy-payall-no-auction.zip
16983-failure-to-use-the-batched-transaction-flow-may-enable-theft.zip		16983-failure-to-use-the-batched-transaction-flow-may-enable-theft.zip
16984-strategy-contracts-balance-tracking-system-could-facilitate.zip		16984-strategy-contracts-balance-tracking-system-could-facilitate.zip
17095-origin-marketplace-repeated-withdraw.zip		17095-origin-marketplace-repeated-withdraw.zip
17097-origin-malicious-erc20-finalization-dos.zip		17097-origin-malicious-erc20-finalization-dos.zip
17100-origin-token-migration-marketplace-reference.zip		17100-origin-token-migration-marketplace-reference.zip
17624-compromise-of-a-single-oracle-enables-limited-control-of-the.zip		17624-compromise-of-a-single-oracle-enables-limited-control-of-the.zip
17856-degate-arbitrary-token-balance-check.zip		17856-degate-arbitrary-token-balance-check.zip
18030-liquity-zero-icr-trove-removal.zip		18030-liquity-zero-icr-trove-removal.zip
18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori.zip		18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori.zip
18201-reentrancy-and-untrusted-contract-call-in-mintmultiple-diffi.zip		18201-reentrancy-and-untrusted-contract-call-in-mintmultiple-diffi.zip
18210-lack-of-return-value-checks-can-lead-to-unexpected-results-t.zip		18210-lack-of-return-value-checks-can-lead-to-unexpected-results-t.zip
18211-external-calls-in-loop-can-lead-to-denial-of-service-trailof.zip		18211-external-calls-in-loop-can-lead-to-denial-of-service-trailof.zip
18213-ousd-allows-users-to-transfer-more-tokens-than-expected-trai.zip		18213-ousd-allows-users-to-transfer-more-tokens-than-expected-trai.zip
18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba.zip		18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba.zip
18260-transfer-operations-may-silently-fail-due-to-the-lack-of-con.zip		18260-transfer-operations-may-silently-fail-due-to-the-lack-of-con.zip
18411-specified-minoutput-will-remain-locked-in-lssvmrouterswapnft.zip		18411-specified-minoutput-will-remain-locked-in-lssvmrouterswapnft.zip
18412-malicious-pair-can-re-enter-veryfastrouter-to-drain-original.zip		18412-malicious-pair-can-re-enter-veryfastrouter-to-drain-original.zip
18431-protocols-invariants-can-be-broken-cyfrin-beanstalk-wells-ma.zip		18431-protocols-invariants-can-be-broken-cyfrin-beanstalk-wells-ma.zip
18433-removeliquidity-logic-is-not-correct-for-generalized-well-fu.zip		18433-removeliquidity-logic-is-not-correct-for-generalized-well-fu.zip
18434-read-only-reentrancy-cyfrin-beanstalk-wells-markdown.zip		18434-read-only-reentrancy-cyfrin-beanstalk-wells-markdown.zip
18534-h-2-earlier-users-in-rollover-queue-can-grief-later-users-sh.zip		18534-h-2-earlier-users-in-rollover-queue-can-grief-later-users-sh.zip
18535-h-3-depositfee-can-be-bypassed-via-deposit-queue-sherlock-no.zip		18535-h-3-depositfee-can-be-bypassed-via-deposit-queue-sherlock-no.zip
18772-h-01-user-can-receive-too-few-tokens-when-l2comptroller-is-u.zip		18772-h-01-user-can-receive-too-few-tokens-when-l2comptroller-is-u.zip
19123-yield-ninja-withdraw-accounting.zip		19123-yield-ninja-withdraw-accounting.zip
19124-h-02-first-vault-depositor-can-steal-subsequent-depositors-t.zip		19124-h-02-first-vault-depositor-can-steal-subsequent-depositors-t.zip
19837-h-01-wrong-fee-calculation-after-totalsupply-was-0-code4rena.zip		19837-h-01-wrong-fee-calculation-after-totalsupply-was-0-code4rena.zip
20018-h-03-when-the-challenge-is-successful-the-user-can-send-toke.zip		20018-h-03-when-the-challenge-is-successful-the-user-can-send-toke.zip
20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen.zip		20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen.zip
20020-h-05-position-owners-can-deny-liquidations-code4rena-franken.zip		20020-h-05-position-owners-can-deny-liquidations-code4rena-franken.zip
20021-h-06-challenger-reward-can-be-used-to-drain-reserves-and-fre.zip		20021-h-06-challenger-reward-can-be-used-to-drain-reserves-and-fre.zip
20057-h-02-it-is-impossible-to-slash-queued-withdrawals-that-conta.zip		20057-h-02-it-is-impossible-to-slash-queued-withdrawals-that-conta.zip
20069-h-01-positionmanagers-moveliquidity-can-freeze-funds-by-remo.zip		20069-h-01-positionmanagers-moveliquidity-can-freeze-funds-by-remo.zip
20070-h-02-positionmanagers-moveliquidity-can-set-wrong-deposit-ti.zip		20070-h-02-positionmanagers-moveliquidity-can-set-wrong-deposit-ti.zip
20071-h-03-position-nft-can-be-spammed-with-insignificant-position.zip		20071-h-03-position-nft-can-be-spammed-with-insignificant-position.zip
20072-h-04-delegation-rewards-are-not-counted-toward-granting-fund.zip		20072-h-04-delegation-rewards-are-not-counted-toward-granting-fund.zip
20073-h-05-incorrect-calculation-of-the-remaining-updatedrewards-l.zip		20073-h-05-incorrect-calculation-of-the-remaining-updatedrewards-l.zip
20074-h-06-the-lender-could-possibly-lose-unclaimed-rewards-in-cas.zip		20074-h-06-the-lender-could-possibly-lose-unclaimed-rewards-in-cas.zip
2017-07-Parity_first_hack.zip		2017-07-Parity_first_hack.zip
2017-11-Parity_kill.zip		2017-11-Parity_kill.zip
2018-04-BEC.zip		2018-04-BEC.zip
2018-04-SmartMesh.zip		2018-04-SmartMesh.zip
2018-10-SpankChain.zip		2018-10-SpankChain.zip
2020-04-LendfMe.zip		2020-04-LendfMe.zip
2020-04-uniswap-erc777.zip		2020-04-uniswap-erc777.zip
2020-06-Balancer_20200628.zip		2020-06-Balancer_20200628.zip
2020-06-Bancor.zip		2020-06-Bancor.zip
2020-08-Opyn.zip		2020-08-Opyn.zip
2020-09-bzx.zip		2020-09-bzx.zip
2020-10-HarvestFinance.zip		2020-10-HarvestFinance.zip
2020-11-Pickle.zip		2020-11-Pickle.zip
2020-12-Cover.zip		2020-12-Cover.zip
2021-01-Sushi_Badger_Digg.zip		2021-01-Sushi_Badger_Digg.zip
2021-02-Yearn_ydai.zip		2021-02-Yearn_ydai.zip
2021-03-PAID.zip		2021-03-PAID.zip
2021-03-dodo_flashloan.zip		2021-03-dodo_flashloan.zip
2021-04-Uranium.zip		2021-04-Uranium.zip
2021-05-BurgerSwap.zip		2021-05-BurgerSwap.zip
2021-05-JulSwap.zip		2021-05-JulSwap.zip
2021-05-PancakeBunny.zip		2021-05-PancakeBunny.zip
2021-05-RariCapital.zip		2021-05-RariCapital.zip
2021-05-Spartan.zip		2021-05-Spartan.zip
2021-05-ValueDefi.zip		2021-05-ValueDefi.zip
2021-05-bEarn.zip		2021-05-bEarn.zip
2021-06-88mph.zip		2021-06-88mph.zip
2021-06-Eleven.zip		2021-06-Eleven.zip
2021-06-PancakeHunny.zip		2021-06-PancakeHunny.zip
2021-06-SafeDollar.zip		2021-06-SafeDollar.zip
2021-06-xWin.zip		2021-06-xWin.zip
2021-07-Chainswap_exp1.zip		2021-07-Chainswap_exp1.zip
2021-07-Chainswap_exp2.zip		2021-07-Chainswap_exp2.zip
2021-07-Levyathan.zip		2021-07-Levyathan.zip
2021-08-Cream.zip		2021-08-Cream.zip
2021-08-PolyNetwork.zip		2021-08-PolyNetwork.zip
2021-08-Popsicle.zip		2021-08-Popsicle.zip
2021-08-WaultFinance.zip		2021-08-WaultFinance.zip
2021-08-XSURGE.zip		2021-08-XSURGE.zip
2021-09-DaoMaker.zip		2021-09-DaoMaker.zip
2021-09-Nimbus.zip		2021-09-Nimbus.zip
2021-09-NowSwap.zip		2021-09-NowSwap.zip
2021-09-Sushimiso.zip		2021-09-Sushimiso.zip
2021-09-ZABU.zip		2021-09-ZABU.zip
2021-10-Cream_2.zip		2021-10-Cream_2.zip
2021-10-IndexedFinance.zip		2021-10-IndexedFinance.zip

About

A public collection of EVM exploit proof-of-concept (PoC) archives for security research, education, and tooling. These PoCs are generated from evm-hack-registry data and are intended to be used with evm-hack-analyzer.

crypto.training/hacks/

audit evm security solidity web3

Activity

27 stars

0 watching

6 forks

Report repository