Smart Contract Attacks Library

Access control vulnerabilities let unauthorized accounts execute privileged operations. OWASP ranks broken access control first in its 2025 Smart C...

Integer overflow and underflow attacks have drained over $1 billion from Decentralized Finance (DeFi) protocols and web3 projects. In April 2018, a...

The Parity Wallet hack froze $150 million and showed that a single vulnerability can permanently destroy an entire protocol. In November 2017, an a...

A flash loan attack uses uncollateralized, same-transaction borrowing to amplify a separate protocol weakness. The loan is not usually the bug: the...

On October 26, 2020, an attacker used price manipulation to extract $34 million from Harvest Finance in about seven minutes. The incident showed ho...

Reentrancy is the classic smart contract vulnerability for a reason: it teaches one of the most important audit lessons in Web3 security. Every ext...

DAO governance attacks manipulate voting power, proposal review, or execution controls to make a protocol authorize harmful actions. The $182 milli...

Frontrunning attacks exploit the transparent nature of blockchain mempools to steal value from unsuspecting users. Imagine playing a game of poker ...

Web3 phishing attacks target the person approving a transaction rather than a flaw in contract code. A malicious signature can grant an attacker pe...

Denial of Service (DOS) vulnerabilities prevent users or administrators from completing an operation. In smart contracts, a blocked withdrawal or s...

A smart contract replay attack reuses a valid signature or transaction to execute an action more times, on more contracts, or on more chains than t...

In November 2017, a GitHub user triggered an unprotected call inside a shared library contract, freezing 513,774 ETH. More than 300 Parity multisig...

Yes. Ethereum smart contract storage variables are publicly readable by anyone, even when marked in Solidity. The modifier controls which Solidity ...

Lotteries, NFT mints, games, and token distributions may depend on outcomes that participants cannot predict or influence. A deterministic blockcha...

An unchecked return value lets a contract continue after an external operation fails. The code may compile and execute without reverting even thoug...