GitHub - sanbir/evm-hack-registry: A self-contained, offline-runnable archive of DeFi exploit proof-of-concepts spanning the full history of EVM hacks (2017 → 2026)

Branches Tags

Name		Name	Last commit message	Last commit date
Latest commit History 93 Commits
Sorry, we had to truncate this directory to 1,000 files. 551 entries were omitted from the list.
15976-h-03-interest-rates-are-incorrect-on-liquidation-code4rena-p_exp		15976-h-03-interest-rates-are-incorrect-on-liquidation-code4rena-p_exp
15977-h-04-anyone-can-prevent-themselves-from-being-liquidated-as_exp		15977-h-04-anyone-can-prevent-themselves-from-being-liquidated-as_exp
15978-h-05-attacker-can-manipulate-low-tvl-uniswap-v3-pool-to-borr_exp		15978-h-05-attacker-can-manipulate-low-tvl-uniswap-v3-pool-to-borr_exp
15979-h-06-discrepency-in-the-uniswap-v3-position-price-calculatio_exp		15979-h-06-discrepency-in-the-uniswap-v3-position-price-calculatio_exp
15980-h-07-user-can-pass-auction-recovery-health-check-easily-with_exp		15980-h-07-user-can-pass-auction-recovery-health-check-easily-with_exp
15981-h-08-nftfloororacles-asset-and-feeder-structures-can-be-corr_exp		15981-h-08-nftfloororacles-asset-and-feeder-structures-can-be-corr_exp
15982-h-09-uniswapv3-tokens-of-certain-pairs-will-be-wrongly-value_exp		15982-h-09-uniswapv3-tokens-of-certain-pairs-will-be-wrongly-value_exp
15983-h-10-attacker-can-drain-pool-using-executebuywithcredit-with_exp		15983-h-10-attacker-can-drain-pool-using-executebuywithcredit-with_exp
16038-h-01-bond-max-buyer-might-end-up-buying-the-max-buy-of-the-n_exp		16038-h-01-bond-max-buyer-might-end-up-buying-the-max-buy-of-the-n_exp
16039-h-02-attacker-can-front-run-bond-buyer-and-make-them-buy-it_exp		16039-h-02-attacker-can-front-run-bond-buyer-and-make-them-buy-it_exp
16040-h-03-dmutesol-attacker-can-push-lock-items-to-victims-array_exp		16040-h-03-dmutesol-attacker-can-push-lock-items-to-victims-array_exp
16736-aztec-swap-validator-missing-pairing-check_exp		16736-aztec-swap-validator-missing-pairing-check_exp
16739-aztec-confidentialapprove-replay-status_exp		16739-aztec-confidentialapprove-replay-status_exp
16760-setminimumdistribution-not-protected_exp		16760-setminimumdistribution-not-protected_exp
16975-lack-of-contract-existence-check-on-delegatecall-may-lead-to_exp		16975-lack-of-contract-existence-check-on-delegatecall-may-lead-to_exp
16976-use-of-delegatecall-in-a-payable-function-inside-a-loop-trai_exp		16976-use-of-delegatecall-in-a-payable-function-inside-a-loop-trai_exp
16980-yield-v2-witch-buy-payall-no-auction_exp		16980-yield-v2-witch-buy-payall-no-auction_exp
16983-failure-to-use-the-batched-transaction-flow-may-enable-theft_exp		16983-failure-to-use-the-batched-transaction-flow-may-enable-theft_exp
16984-strategy-contracts-balance-tracking-system-could-facilitate_exp		16984-strategy-contracts-balance-tracking-system-could-facilitate_exp
17095-origin-marketplace-repeated-withdraw_exp		17095-origin-marketplace-repeated-withdraw_exp
17097-origin-malicious-erc20-finalization-dos_exp		17097-origin-malicious-erc20-finalization-dos_exp
17100-origin-token-migration-marketplace-reference_exp		17100-origin-token-migration-marketplace-reference_exp
17624-compromise-of-a-single-oracle-enables-limited-control-of-the_exp		17624-compromise-of-a-single-oracle-enables-limited-control-of-the_exp
17856-degate-arbitrary-token-balance-check_exp		17856-degate-arbitrary-token-balance-check_exp
18030-liquity-zero-icr-trove-removal_exp		18030-liquity-zero-icr-trove-removal_exp
18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori_exp		18200-proposals-could-allow-timelockadmin-takeover-trailofbits-ori_exp
18201-reentrancy-and-untrusted-contract-call-in-mintmultiple-diffi_exp		18201-reentrancy-and-untrusted-contract-call-in-mintmultiple-diffi_exp
18210-lack-of-return-value-checks-can-lead-to-unexpected-results-t_exp		18210-lack-of-return-value-checks-can-lead-to-unexpected-results-t_exp
18211-external-calls-in-loop-can-lead-to-denial-of-service-trailof_exp		18211-external-calls-in-loop-can-lead-to-denial-of-service-trailof_exp
18213-ousd-allows-users-to-transfer-more-tokens-than-expected-trai_exp		18213-ousd-allows-users-to-transfer-more-tokens-than-expected-trai_exp
18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba_exp		18214-ousd-total-supply-can-be-arbitrary-even-smaller-than-user-ba_exp
18260-transfer-operations-may-silently-fail-due-to-the-lack-of-con_exp		18260-transfer-operations-may-silently-fail-due-to-the-lack-of-con_exp
18411-specified-minoutput-will-remain-locked-in-lssvmrouterswapnft_exp		18411-specified-minoutput-will-remain-locked-in-lssvmrouterswapnft_exp
18412-malicious-pair-can-re-enter-veryfastrouter-to-drain-original_exp		18412-malicious-pair-can-re-enter-veryfastrouter-to-drain-original_exp
18431-protocols-invariants-can-be-broken-cyfrin-beanstalk-wells-ma_exp		18431-protocols-invariants-can-be-broken-cyfrin-beanstalk-wells-ma_exp
18433-removeliquidity-logic-is-not-correct-for-generalized-well-fu_exp		18433-removeliquidity-logic-is-not-correct-for-generalized-well-fu_exp
18434-read-only-reentrancy-cyfrin-beanstalk-wells-markdown_exp		18434-read-only-reentrancy-cyfrin-beanstalk-wells-markdown_exp
18534-h-2-earlier-users-in-rollover-queue-can-grief-later-users-sh_exp		18534-h-2-earlier-users-in-rollover-queue-can-grief-later-users-sh_exp
18535-h-3-depositfee-can-be-bypassed-via-deposit-queue-sherlock-no_exp		18535-h-3-depositfee-can-be-bypassed-via-deposit-queue-sherlock-no_exp
18772-h-01-user-can-receive-too-few-tokens-when-l2comptroller-is-u_exp		18772-h-01-user-can-receive-too-few-tokens-when-l2comptroller-is-u_exp
19123-yield-ninja-withdraw-accounting_exp		19123-yield-ninja-withdraw-accounting_exp
19124-h-02-first-vault-depositor-can-steal-subsequent-depositors-t_exp		19124-h-02-first-vault-depositor-can-steal-subsequent-depositors-t_exp
19837-h-01-wrong-fee-calculation-after-totalsupply-was-0-code4rena_exp		19837-h-01-wrong-fee-calculation-after-totalsupply-was-0-code4rena_exp
20018-h-03-when-the-challenge-is-successful-the-user-can-send-toke_exp		20018-h-03-when-the-challenge-is-successful-the-user-can-send-toke_exp
20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen_exp		20019-h-04-transfer-position-ownership-to-addr0-to-dos-end-challen_exp
20020-h-05-position-owners-can-deny-liquidations-code4rena-franken_exp		20020-h-05-position-owners-can-deny-liquidations-code4rena-franken_exp
20021-h-06-challenger-reward-can-be-used-to-drain-reserves-and-fre_exp		20021-h-06-challenger-reward-can-be-used-to-drain-reserves-and-fre_exp
20056-h-01-slot-and-block-number-proofs-not-required-for-verificat_exp		20056-h-01-slot-and-block-number-proofs-not-required-for-verificat_exp
20057-h-02-it-is-impossible-to-slash-queued-withdrawals-that-conta_exp		20057-h-02-it-is-impossible-to-slash-queued-withdrawals-that-conta_exp
20069-h-01-positionmanagers-moveliquidity-can-freeze-funds-by-remo_exp		20069-h-01-positionmanagers-moveliquidity-can-freeze-funds-by-remo_exp
20070-h-02-positionmanagers-moveliquidity-can-set-wrong-deposit-ti_exp		20070-h-02-positionmanagers-moveliquidity-can-set-wrong-deposit-ti_exp
20071-h-03-position-nft-can-be-spammed-with-insignificant-position_exp		20071-h-03-position-nft-can-be-spammed-with-insignificant-position_exp
20072-h-04-delegation-rewards-are-not-counted-toward-granting-fund_exp		20072-h-04-delegation-rewards-are-not-counted-toward-granting-fund_exp
20073-h-05-incorrect-calculation-of-the-remaining-updatedrewards-l_exp		20073-h-05-incorrect-calculation-of-the-remaining-updatedrewards-l_exp
20074-h-06-the-lender-could-possibly-lose-unclaimed-rewards-in-cas_exp		20074-h-06-the-lender-could-possibly-lose-unclaimed-rewards-in-cas_exp
2017-07-Parity_first_hack_exp		2017-07-Parity_first_hack_exp
2017-11-Parity_kill_exp		2017-11-Parity_kill_exp
2018-04-BEC_exp		2018-04-BEC_exp
2018-04-SmartMesh_exp		2018-04-SmartMesh_exp
2018-10-SpankChain_exp		2018-10-SpankChain_exp
2020-04-LendfMe_exp		2020-04-LendfMe_exp
2020-04-uniswap-erc777		2020-04-uniswap-erc777
2020-06-Balancer_20200628_exp		2020-06-Balancer_20200628_exp
2020-06-Bancor_exp		2020-06-Bancor_exp
2020-08-Opyn_exp		2020-08-Opyn_exp
2020-09-bzx_exp		2020-09-bzx_exp
2020-10-HarvestFinance_exp		2020-10-HarvestFinance_exp
2020-11-Pickle_exp		2020-11-Pickle_exp
2020-12-Cover_exp		2020-12-Cover_exp
2021-01-Sushi_Badger_Digg_exp		2021-01-Sushi_Badger_Digg_exp
2021-02-Yearn_ydai_exp		2021-02-Yearn_ydai_exp
2021-03-PAID_exp		2021-03-PAID_exp
2021-03-dodo_flashloan_exp		2021-03-dodo_flashloan_exp
2021-04-Uranium_exp		2021-04-Uranium_exp
2021-05-BurgerSwap_exp		2021-05-BurgerSwap_exp
2021-05-JulSwap_exp		2021-05-JulSwap_exp
2021-05-PancakeBunny_exp		2021-05-PancakeBunny_exp
2021-05-RariCapital_exp		2021-05-RariCapital_exp
2021-05-Spartan_exp		2021-05-Spartan_exp
2021-05-ValueDefi_exp		2021-05-ValueDefi_exp
2021-05-bEarn_exp		2021-05-bEarn_exp
2021-06-88mph_exp		2021-06-88mph_exp
2021-06-Eleven_exp		2021-06-Eleven_exp
2021-06-PancakeHunny_exp		2021-06-PancakeHunny_exp
2021-06-SafeDollar_exp		2021-06-SafeDollar_exp
2021-06-xWin_exp		2021-06-xWin_exp
2021-07-Chainswap_exp1		2021-07-Chainswap_exp1
2021-07-Chainswap_exp2		2021-07-Chainswap_exp2
2021-07-Levyathan_exp		2021-07-Levyathan_exp
2021-08-Cream_exp		2021-08-Cream_exp
2021-08-PolyNetwork_exp		2021-08-PolyNetwork_exp
2021-08-Popsicle_exp		2021-08-Popsicle_exp
2021-08-WaultFinance_exp		2021-08-WaultFinance_exp
2021-08-XSURGE_exp		2021-08-XSURGE_exp
2021-09-DaoMaker_exp		2021-09-DaoMaker_exp
2021-09-Nimbus_exp		2021-09-Nimbus_exp
2021-09-NowSwap_exp		2021-09-NowSwap_exp
2021-09-Sushimiso_exp		2021-09-Sushimiso_exp
2021-09-ZABU_exp		2021-09-ZABU_exp
2021-10-Cream_2_exp		2021-10-Cream_2_exp