Leaderboard
671All-time rank
P
Pawnfi
Jun 17, 2023
$820K
Lost
$820K
Recovered
$0
Net loss
$820K
Unrecovered0% recovered
Pawnfi's ApeStaking contract allowed attackers to use the same NFT as collateral multiple times for borrowing APE tokens. The vulnerability stemmed from missing NFT transfer verification in the depositAndBorrowApeAndStake() function, enabling an attacker to borrow without securing proper collateral by leveraging an already-staked NFT.
How the exploit worked
View reproducible PoCBusiness Logic Flaw.
Lost: ~$820K
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Token & Share Accounting
- Technique
- Incorrect Share Accounting
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Jun 17, 2023Exploit executed — $820K drained via incorrect share accounting
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)