Leaderboard
258All-time rank
Exactly
Aug 18, 2023
$7.6M
Lost
$7.6M
Recovered
$0
Net loss
$7.6M
Unrecovered0% recovered
Exactly Protocol's DebtManager on Optimism was exploited on August 18, 2023 when unvalidated market address parameter allowed attacker to bypass permit checks and reenter crossDeleverage to steal users' deposited collateral. A copycat repeated the attack the same day.
How the exploit worked
View reproducible PoCinsufficient validation.
Lost: ~$7M
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Optimism
Event timeline
- Aug 18, 2023Exploit executed — $7.6M drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)