Audit tooling
Pick a protocol category. You get the root causes that killed similar protocols, the protocols they killed, and the checks that find them.
A pool whose reserves the attacker can move is used to price collateral — flash loans let the price be moved, then borrow against it.
KilledHundred FinanceVenusMoola Market
Checks
grep -rn "getReserves\|price0Cumulative\|TWAP" <repo>Check every collateral price source: is it a Chainlink feed, a TWAP, or a live pool read?Test: flash-loan the pricing pool by 20% — does max-borrow change?Transferring tokens directly to a vault inflates its share price or the apparent balance, which an attacker redeems or borrows against.
KilledVenus THECurve LlamaLendBalancer (2020)
Checks
grep -rn "balanceOf(address(this))" <repo> — every raw balance used in math is a donation surfaceCheck the first-depositor guard: virtual shares / MINIMUM_LIQUIDITY present?Test: donate 1 token then deposit/redeem — any gain?An action that changes a reward-earning position (merge, split, kill gauge, poke) skips the accrual/checkpoint update — rewards double-count or leak.
KilledAlchemix (16 criticals from one poke bug)Yearn yDAI
Checks
For every position-mutating function: is _updateRewards / checkpoint called BEFORE the mutation?grep -rn "function poke\|function merge\|function reset" <repo>ERC777/ERC721 callbacks or plain external calls after a stale health check let an attacker re-enter and borrow repeatedly against the same collateral.
KilledLendf.MeCream FinanceOmni
Checks
grep -rn "safeTransferFrom\|.call(" <repo> — is state updated BEFORE every external call?Check for nonReentrant on all borrow/withdraw/liquidate pathsInsolvent-position fees are paid from a shared pool (fee vault, insurance fund) — mass insolvency drains it, or the fee math lets liquidators extract more than the position holds.
KilledAlchemix (calculateLiquidation outsourced fee)Fluid Protocol
Checks
Trace the liquidation fee source when debt >= collateralTest: insolvent position with feeBps=100% — who pays?A proxy implementation or contract with a public initialize() and no initialized-guard lets anyone re-run init and take ownership.
KilledHarvest FinanceParityAudius
Checks
grep -rn "function initialize\|function init" <repo> — is there an initializer modifier or a first-call guard?For every proxy: can anyone call the implementation directly?Index updates that floor or ceil in the protocol-favored direction compound over time, or an off-by-one lets users time deposits between accruals.
KilledSilo FinanceDFX (2-decimal token)
Checks
Derive the index update: which direction does rounding favor, and does it compound?Test same-block deposit→accrue→withdrawA fork changes a constant (10000 vs 1000) and the invariant math silently breaks — classic death by copy-paste.
KilledUranium FinanceNowSwapNimbus
Checks
Diff every math constant against the original protocol it was forked fromgrep -rn "1e3\|10000\|1000" <repo> in pair/pool mathA pair between a token and itself (or two correlated tokens) computes price from reserves — swapping the same token inflates it 1:1 and the pool values it as worth.
KilledMonoX ($31M)
Checks
Does the router reject tokenIn == tokenOut?Check price = reserveA/reserveB when A and B are the same assetSwap paths without a minimum-out let anyone sandwich the entire output — the user gets dust, the attacker gets the difference.
KilledAlchemistAllocator (minIntermediateOut:0 class)Sushi/Uniswap clones
Checks
grep -rn "minAmountOut\|amountOutMin" <repo> — any call site passing 0 or omitting the check?The contract books the full amount but receives less (or more) — the ledger desyncs from the real balance and the pool pays out other users' funds.
KilledMultiple 2021-22 token exploitsSafeDollar
Checks
Does the contract support fee-on-transfer tokens? If yes: book balances by measured delta, never by the argumentAn emergencyBurn or migrate path moves funds without reconciling internal shares — deposit is counted twice.
KilledEleven Finance ($4.5M)PancakeBunny-family
Checks
grep -rn "emergency\|burn\|rescue" <repo> — does each path update shares/balances?Test deposit→burn→withdraw: can you extract more than your deposit?A view/try-catch pattern reads the pool state mid-callback, so the attacker re-enters against stale pricing.
KilledCurve (read-only reentrancy class)
Checks
Any external call between reading a price/balance and using it?Add a transient reentrancy guard even for view-based flowsA tiny first deposit + donation rounds the share price so later depositors mint 0 shares or lose value to rounding.
KilledBalancer (2020)Uniswap-v2 clones without MINIMUM_LIQUIDITY
Checks
First-depositor protection present?Test deposit(1 wei) → donate → victim deposits — shares minted?require(v >= threshold) written backwards — any single validator can sign withdrawals.
KilledRonin ($625M)
Checks
Read every multisig/validator check literally: is the comparison direction correct?grep -rn "require.*>=\|require.*<=" <repo> in signature/multisig codeA zero-hash or default-proved path lets any message pass verification and mint on the destination.
KilledNomad ($190M)
Checks
Trace the "verified root" path: is there a branch where an empty/unverified root is accepted?Test: call the execute path with a forged/empty proofThe bridge implementation's initialize() was never called (or is callable by anyone) — anyone becomes owner of the bridge.
KilledWormhole ($326M)Qubit (tokenAddress=0)
Checks
For every deployed proxy: check the initialized flag on-chainTest: call initialize() from a random EOAMessages can be replayed across chains, or the same hash executes twice because the nonce is missing/wrong.
KilledChainswapPoly Network
Checks
Is there a consumed-message mapping keyed by hash+chain?Test: submit the same message twiceA zero-address token, a fake token with the right name, or an amount that does not exist passes validation and mints/credits.
KilledQubit ($80M)
Checks
Is tokenAddress validated against a whitelist, not just != 0?Test: deposit with address(0) or a minted clone tokenOne verifier (or a config shared by many apps) is the whole security boundary — compromise or misconfig drains everything.
KilledKelpDAO ($292M)LayerZero 47% shared config
Checks
Map the trust boundary: how many independent parties must collude to mint?Check the verifier-set config is not shared across unrelated appsu256→u128 or cross-VM integer truncation on the bridge mints depegged wrapped assets.
KilledAstarMoonbeam/Acala (Frontier)
Checks
Every cross-chain amount conversion: explicit bounds checks?grep -rn "toUint128\|uint128(" <repo>An action that should run once per epoch (poke, reset, checkpoint) runs every time — rewards mint unboundedly.
KilledAlchemix v2 — 16 confirmed criticals from one poke()
Checks
grep -rn "onlyNewEpoch\|lastEpoch" <repo> — is the guard on EVERY accrual path?When a position NFT is burned or merged, unclaimed rewards are not forced out first — they freeze or are stolen.
KilledAlchemix veALCX mergeve(3,3) forks broadly
Checks
Trace merge/burn: is _claim called before _burn?withdraw/reset change voting power without decrementing the tracked total — bribe distribution math breaks and users claim unearned bribes.
KilledAlchemix Bribe.sol
Checks
For every state-mutating function: does the aggregate (totalVoting/totalSupply) move in the SAME direction? Build the asymmetry table.A revenue checkpoint adds the current unclaimed balance as new revenue — the same tokens accrue twice.
KilledAlchemix RevenueHandler
Checks
Read every "+= balance" in reward math: is the balance already accounted?After a gauge/strategy is killed, its weight is not revalidated — it keeps eating the reward share.
KilledAlchemix MinterCurve gauge family
Checks
After kill: is the weight zeroed or skipped in distribution?Fees/lock params change and apply to EXISTING positions with no snapshot — locked users get new terms they never agreed to.
KilledTransmuter fee classMultiple staking protocols
Checks
Are params snapshotted per position, or read globally at claim time?Voting power is bought seconds before a proposal, votes, then sold — no lock means the DAO is controlled for the cost of fees.
KilledBeanstalk ($181M)
Checks
Is voting power snapshotted BEFORE the proposal, or live balanceOf at vote time?The governance proxy's init is callable by anyone: voting period 0, attacker as guardian, then a transfer-99%-of-treasury proposal.
KilledAudius ($1.08M)Compound-style clones
Checks
initialized guard on the governance proxy? Test calling initialize() from an EOAProposals execute instantly (or the delay can be set to 0) so the attack completes in one block.
KilledAudius (3-block voting period)Multiple DAO forks
Checks
Check votingPeriod/executionDelay lower bounds — can they be set to 0?Self-delegation or duplicated votes satisfy quorum without real support, or a defeated proposal becomes executable later.
KilledAlchemix v2 findingsGovernor forks
Checks
Can one account delegate to itself multiple times?Are defeated proposals permanently dead?fillSellOrder validates the seller's signature but not the buyer — the attacker fills their own order with the victim's tokens.
KilledQuixotic
Checks
Every marketplace fill: is msg.sender checked against the buyer field?safeTransferFrom triggers the receiver's hook mid-health-check — collateral is re-supplied against stale state.
KilledOmni
Checks
State updated BEFORE every safeTransferFrom of a collateral NFT?Attacker-controlled fields rendered into tokenURI/SVG without escaping — XSS through NFT metadata, or the URI is mutable after sale.
KilledNFT metadata XSS classLoot-style exploits
Checks
Is every user-controlled string escaped in the SVG/JSON?Is the tokenURI frozen at mint?Outbid refunds, fee splits, or bid cancellation return wrong amounts or let the owner sweep both the bid and the item.
KilledFlippazOne (ownerWithdrawAllTo without onlyOwner)Multiple NFT markets
Checks
grep -rn "ownerWithdraw\|rescue\|withdrawAll" <repo> — access control on every onelatestRoundData is consumed without checking updatedAt — a stale or poisoned price passes.
KilledFrxEthEth dual-oracle classMultiple 2022-23 exploits
Checks
grep -rn "latestRoundData" <repo> — are roundId/answeredInRound/updatedAt all validated?Two feeds are averaged or picked without checking they agree — one manipulated feed drags the price.
KilledAlchemix H-02/H-09 class
Checks
Is the spread between feeds bounded before use?On L2s the sequencer can go down while the feed serves stale prices — prices are accepted as fresh.
KilledL2 oracle class
Checks
On L2: is the sequencer-uptime feed checked before consuming prices?A feed with 8 decimals is multiplied as if 18 (or vice versa) — every price is off by 1e10.
KilledDecimal-mishandling incidents across 2021-23
Checks
Normalize every feed to 1e18 with an explicit decimals read — never hardcodevalue * count (or value + fee) wraps unchecked — the sum passes the balance check while each receiver gets the huge value.
KilledBEC ($6B at peak)SmartMesh
Checks
Every batch transfer: checked math on the sum?grep -rn "unchecked" <repo> in transfer logicA transfer helper left public (or default visibility) lets anyone move anyone's tokens.
KilledCF Token
Checks
grep -rn "function _transfer\|function _mint\|function _burn" <repo> — visibility correct on all?transfer(ownAddress) triggers the reward/burn logic on the sender — looping self-transfers inflates the balance.
KilledLPC
Checks
Self-transfer must be a no-op. Test transfer(address(this), x).The token takes a cut on transfer but the contract books the full amount — the ledger desyncs.
KilledFee-on-transfer class
Checks
Balance by delta: measure before/after, never trust the argumentMissing nonce/chainId/domain checks (or malleable signatures) let permits replay or be forged.
KilledSignature-validation class
Checks
permit: nonce++, chainId bound, s-malleability check?A hidden owner-only drain or an ownership chain relayed through dozens of wallets empties everything locked.
KilledDxSale locker ($7.3M via 89-wallet relay)SKP rug
Checks
Map every privileged function — is any of them a silent drain?