XCarnival Hack
Reported loss
$3.8M
Stale collateral order authorization
What happened
XCarnival's Ethereum NFT-lending contracts were exploited in June 2022 for roughly $3.8 million. Withdrawn NFTs left usable borrowing order IDs behind, allowing loans without retained collateral. Contemporaneous reporting describes a negotiated partial return after operations were paused.
Technical root cause
Borrowing order IDs stayed valid after the pledged NFT collateral was withdrawn.
How it happened
- The attacker created several child contracts.
- Each deposited an NFT, obtained an
orderID, then withdrew and passed the NFT on for reuse. - The contracts borrowed ETH using order IDs that had not been invalidated after withdrawal.
- XCarnival paused operations and negotiated with the attacker.
Protocol details
Classification
Borrowing and Lending / NFT / Protocol Logic
Protocol Type
NFT Lending
Affected asset / contract
XCV
Implementation language
Solidity
Protocol links
Website
@XCarnival_Lab
Security review history
- PeckShield View report
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
