Leaderboard
985All-time rank
C
CIVNFT
Jul 8, 2023
$180K
Lost
$180K
Recovered
$0
Net loss
$180K
Unrecovered0% recovered
CIVNFT smart contract shipped fund-transfer functions with zero access control. An attacker exploited this to initiate callback functions that transferred CIV and USDT funds to Uniswap for liquidation.
How the exploit worked
View reproducible PoCLack of access control.
Lost: ~$180k
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Jul 8, 2023Exploit executed — $180K drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)