Kaon Գին

A Historical Collection of Reentrancy Attacks

<!-- SC_OFF --><div class="md"><p>As part of my effort to prevent <a href="https://github.com/ethereum/solidity/issues/12996#issuecomment-1187381059">reentrancy attacks</a> at the (Solidity) language level, I compiled a list of known reentrancy attacks.</p> <p>A chronological and (hopefully) complete list of reentrancy attacks to date:</p> <ul> <li><a href="https://github.com/pcaversaccio/reentrancy-attacks/issues/1#issuecomment-1188680199">WETH white hat attack</a> – June 11, 2016</li> <li><a href="https://medium.com/@zhongqiangc/smart-contract-reentrancy-thedao-f2da1d25180c">The DAO attack</a> – June 17, 2016</li> <li><a href="https://medium.com/swlh/how-spankchain-got-hacked-af65b933393c">SpankChain attack</a> – October 9, 2018</li> <li><a href="https://defirate.com/imbtc-uniswap-hack">imBTC Uniswap pool attack</a> – April 18, 2020</li> <li><a href="https://slowmist.medium.com/slowmist-details-of-lendf-me-reentrancy-attack-3e168ab5f2b1">Lendf.Me attack</a> – April 19, 2020</li> <li><a href="https://peckshield.medium.com/akropolis-incident-root-cause-analysis-c11ee59e05d4">Akropolis attack</a> – November 12, 2020</li> <li><a href="https://inspexco.medium.com/value-defis-invalid-share-calculation-exploit-in-depth-analysis-1c8f97c1416e">ValueDeFi attack</a> – May 7, 2021</li> <li><a href="https://nipunp.medium.com/5-8-21-rari-capital-exploit-timeline-analysis-8beda31cbc1a">Rari Capital attack</a> – May 8, 2021</li> <li><a href="https://quillhashteam.medium.com/burgerswap-flash-loan-attack-analysis-888b1911daef">BurgerSwap attack</a> – May 27, 2021</li> <li><a href="https://thedefiant.io/not-just-a-bank-run-new-evidence-shows-iron-finance-crashed-due-to-code-exploit">Iron Finance attack</a> – June 16, 2021</li> <li><a href="https://polydex.medium.com/plx-locker-smart-contract-incident-post-mortem-75342124a3e8">PolyDEX attack</a> – June 20, 2021</li> <li><a href="https://medium.com/defipie/hacking-investigation-85e07454f1c9">DeFiPie attack</a> – July 12, 2021</li> <li><a href="https://sanshunft.medium.com/woofdate-2-2-0-keanu-compensation-mfund-rebase-update-bcac09707e19">Sanshu Inu attack</a> – July 20, 2021</li> <li><a href="https://inspexco.medium.com/reentrancy-attack-on-cream-finance-incident-analysis-1c629686b6f5">C.R.E.A.M. Finance attack</a> – August 30, 2021</li> <li><a href="https://rekt.news/grim-finance-rekt">Grim Finance attack</a> – December 18, 2021</li> <li><a href="https://medium.com/visorfinance/post-mortem-for-vvisr-staking-contract-exploit-and-upcoming-migration-7920e1dee55a">Visor Finance attack</a> – December 21, 2021</li> <li><a href="https://blocksecteam.medium.com/when-safemint-becomes-unsafe-lessons-from-the-hypebears-security-incident-2965209bda2a">HypeBears attack</a> – February 3, 2022</li> <li><a href="https://coincodecap.com/bacon-protocol-hacked-reportedly-1m-lost">Bacon Protocol attack</a> – March 5, 2022</li> <li><a href="https://coincodecap.com/paraluni-hacked-reportedly-1-7m-lost">Paraluni attack</a> – March 13, 2022</li> <li><a href="https://twitter.com/danielvf/status/1503756428212936710">Hundred Finance attack</a> – March 15, 2022</li> <li><a href="https://twitter.com/Mudit__Gupta/status/1503783633877827586">Agave Finance attack</a> – March 16, 2022</li> <li><a href="https://slowmist.medium.com/revest-finance-incident-analysis-6fcd9b6be207">Revest Finance attack</a> – March 27, 2022</li> <li><a href="https://rekt.news/voltage-finance-rekt">Voltage Finance attack</a> – March 31, 2022</li> <li><a href="https://certik.medium.com/fei-protocol-incident-analysis-8527440696cc">Fei Protocol attack</a> – April 30, 2022</li> <li><a href="https://bistroo.medium.com/post-incident-review-bist-single-asset-staking-binancesmartchain-security-breach-5194590605f">Bistroo attack</a> – May 7, 2022</li> <li><a href="https://twitter.com/ownlyio/status/1524362090940895234">Ownly attack</a> – May 10, 2022</li> <li><a href="https://twitter.com/BlockSecTeam/status/1546141457933025280">Omni attack</a> – July 10, 2022</li> </ul> <p>This list can also be found in my repository <a href="https://github.com/pcaversaccio/reentrancy-attacks">here</a>.</p> <p>I also think I found the first (10 Jun 2016) reentrancy attack contract available on GitHub <a href="https://gist.github.com/vessenes/9d84df668893c43dcd968ee28a03cd2b">here</a>. This contract was built by Peter Vessenes who was raising the issue to the Solidity/DAO team. </p> <p>Finally, for anyone interested in the history behind the first reentrancy attack I really recommend checking out <a href="https://github.com/pcaversaccio/reentrancy-attacks/issues/1">issue 1</a> in my reentrancy-attacks list repo; awesome historical insights!</p> <p>I try my best to find internet archive links to all relevant URLs in order to preserve history!</p> </div><!-- SC_ON -->   submitted by   <a href="https://www.reddit.com/user/pcaversaccio"> /u/pcaversaccio </a> <br/> <span><a href="https://www.reddit.com/r/ethereum/comments/w8dlnw/a_historical_collection_of_reentrancy_attacks/">[link]</a></span>   <span><a href="https://www.reddit.com/r/ethereum/comments/w8dlnw/a_historical_collection_of_reentrancy_attacks/">[comments]</a></span>