Leaderboard
82All-time rank
H
Hedgey
Apr 19, 2024
$44.7M
Lost
$44.7M
Recovered
$0
Net loss
$44.7M
Unrecovered0% recovered
7M (USDC, NOBL, MASA, BONUS) from Arbitrum and Ethereum vaults. Attacker exploited missing validation in createLockedCampaign, using flashloans to bypass access controls and create fraudulent approvals.
How the exploit worked
View reproducible PoCLogic Flaw.
Lost: 48M USD
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Input Validation
- Technique
- Missing Input Validation
- Attribution
- Unknown
- Chains
ArbitrumEthereum
Event timeline
- Apr 19, 2024Exploit executed — $44.7M drained via missing input validation
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)