GemPad Hack

Reported loss $2.0M
Base BNB Chain Ethereum
Reentrancy

What happened

On December 17, 2024, an attacker exploited a reentrancy flaw in GemPad's multi-chain liquidity-locking infrastructure. Reports put the loss at roughly $1.9 million in locked tokens across Ethereum, BNB Chain, and Base.

How it happened

  1. The attacker deployed malicious token contracts that could call back during token transfers.
  2. They used GemPad's vulnerable collectFees path while creating or interacting with LP locks.
  3. The external callback re-entered the lock contract before its state was safely finalized.
  4. Repeated reentry withdrew locked liquidity multiple times across the shared contracts on Ethereum, BNB Chain, and Base.

Protocol details

Classification Gaming / Metaverse / Reentrancy
Protocol Type Exploit/Other
Protocol links Website

Evidence

Understand the attack patterns

Compare incidents →
Reentrancy

Same attack technique

Browse all hacks →
Mantle Minterest $1.5M lost Fuse Ola Finance $4.7M lost Ethereum Lendf.me $25.2M lost Ethereum The DAO $60.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes