Résumé
On 22 April 2018 the Beauty Ecosystem Coin (BEC) ERC-20 token on Ethereum was drained by the classic batchOverflow attack, generating roughly 10^58 BEC and collapsing the token's value. The vulnerable batchTransfer(_receivers, _value) computed amount = cnt * _value in unchecked Solidity 0.4.x arithmetic, where cnt was the receiver count. The attacker passed two receivers with _value = 0x8000...0000 (2^255), so amount = 2 * 2^255 overflowed uint256 back to zero. That zero total passed the require(_value > 0 && balances[msg.sender] >= amount) balance check, yet the loop still credited each of the two receivers 2^255 tokens. This is a textbook unchecked integer (multiplication) overflow, assigned CVE-2018-10299, and it triggered the discovery of the same batchOverflow pattern in dozens of other ERC-20 contracts.
Comment l’éviter dans votre code
- Use Solidity >=0.8 checked arithmetic or OpenZeppelin SafeMath for every multiply/add on token amounts and supplies
- Never validate a balance against a product computed in unchecked arithmetic; compute and check each per-receiver debit
- Reject zero or absurdly large transfer values; bound _value and the total against totalSupply before crediting anyone
- Fuzz-test batch functions with boundary inputs (2^255, MAX_UINT/cnt) to catch overflow that bypasses require guards
Références
Vulnérabilités liées
Tout Web3 →- CRITICALWEB3-CETUS-SUI-2025
On 22 May 2025, Cetus Protocol, the largest decentralized exchange on the Sui blockchain, was drained of about $223 million in the time it takes to read this sentence. The attacker did not steal a key or trick a signer. They found a single wrong constant in an overflow check, buried not in Cetus's own code but in a shared open-source math library, integer-mate, that Cetus and several other Sui projects all depended on. With a one-token deposit and a flash loan, they convinced the protocol that a position worth almost nothing was worth a fortune, then withdrew the real reserves. It is the cleanest modern example of a vulnerability in a dependency draining the protocols built on top of it, and the second largest crypto theft of 2025 after Bybit.
- CRITICALWEB3-CETUS-2025
On May 22, 2025 Cetus Protocol, the leading DEX on Sui, was drained of approximately $223M. The root cause was a flawed overflow check: the checked_shlw function in the integer-mate math library built its guard mask as 0xFFFFFFFFFFFFFFFF << 192 instead of 0x1 << 192, so values above 2^192 slipped past the check and the subsequent 64-bit left shift silently overflowed (left shifts do not abort in Move). The flaw lived in get_delta_a, which computes the tokens needed for a liquidity position; under the overflow the numerator wrapped to a tiny value, so the function demanded as little as 1 token unit for an enormous liquidity amount. Using flash swaps (borrowing ~10M haSUI), the attacker opened a tight-range position (ticks [300000, 300200]) and minted a massive amount of liquidity for a negligible deposit, then withdrew real pool reserves. Around $162M was frozen on-chain by Sui validators and eventually returned, while roughly $62M was bridged out to Ethereum. Cetus relaunched after recovering and replenishing affected pool liquidity.
- CRITICALWEB3-VELOCORE-2024
On June 2, 2024, the DEX Velocore was drained of about $6.8 million from its constant-product (volatile) pools on Linea and zkSync Era. The root cause combined a missing access-control modifier with an unchecked arithmetic underflow in the ConstantProductPool fee math: velocore__execute performed Vault-only state changes but had no onlyVault check, so anyone could call it directly. The pool's feeMultiplier, which increases per withdrawal and resets each block to deter free swaps, fed an effective fee computed as fee1e9 * feeMultiplier / 1e9 with no upper bound and inside an unchecked block. By repeatedly invoking velocore__execute to inflate feeMultiplier, the attacker drove effectiveFee1e9 above 100% (> 1e9), so the growth term 1e18 - ((1e18 - k) * effectiveFee1e9) / 1e9 underflowed and wrapped to a huge unsigned value, causing a small single-token withdrawal to be accounted as a massive deposit and mint excessive LP tokens. Linea controversially paused its sequencer for about an hour to stop the remaining funds from bridging out.
- CRITICALWEB3-KYBERSWAP-2023
On November 23, 2023 KyberSwap Elastic was exploited across six chains for over $48M (>$20M Arbitrum, $15M Optimism, $7.5M Ethereum, $3M Polygon, $2M Base, ~$23K Avalanche). The root cause was a rounding-direction bug in the concentrated-liquidity math: estimateIncrementalLiquidity should have rounded delta liquidity up so the final price rounded down, but it used mulDivFloor and rounded delta liquidity down, pushing the computed sqrt price slightly past a tick boundary without legitimately crossing it. Using Aave flash loans, the attacker first swapped to park the price in a liquidity-empty region, calibrated a tight position, then performed extremely precise swaps so the price landed exactly on a tick's sqrt price. This forced _updateLiquidityAndCrossTick to register a crossing in computeSwapStep twice, double-counting the tick's liquidity on the reverse swap and paying out far more output than backed, draining the pools. The attacker later opened negotiations; most funds were not promptly recovered.
- CRITICALWEB3-KELPDAO-LAYERZERO-2026
On April 18, 2026, North Korea's Lazarus Group drained about 116,500 rsETH (roughly $292 million) from KelpDAO's LayerZero-based bridge, the largest DeFi exploit of the year. No smart contract was broken; the contracts did exactly what they were written to do. The attack was against the bridge's off-chain verification. rsETH's LayerZero channel was configured to trust a single verifier (a 1-of-1 DVN), so the attackers compromised LayerZero's internal RPC nodes, knocked out the honest external node with a denial-of-service flood, and forced that single verifier to attest to a cross-chain message that never really happened. The Ethereum side then released unbacked rsETH from escrow, leaving wrapped rsETH stranded across more than twenty chains and triggering a bank-run across DeFi.
- HIGHWEB3-FRONTEND-DNS-HIJACK-2022
A frontend hijack leaves the on-chain contracts untouched but replaces the Web2 surface serving the dApp UI with a wallet-drainer clone, so no Solidity audit can catch it. The recurring pattern: attackers take over the domain registrar or DNS provider account (or a CDN/tag-manager account), repoint the domain to a cloned site, and prompt visitors to sign malicious token approvals, EIP-2612 permit signatures, or transfers. Curve Finance was hit twice: on August 9-10, 2022 its curve.fi domain was DNS-hijacked via a compromised nameserver and drained ~$570K in USDC/DAI; and again around May 12, 2025 at the registrar level, after which Curve permanently migrated to curve.finance and announced an ENS move (Convex Finance and Resupply, which depend on Curve's data feeds, suffered dependency-driven outages but were not themselves compromised). In July 2024 a mass wave hit DeFi domains registered through Squarespace, whose forced migration off Google Domains stripped 2FA: Compound's frontend redirected to an Inferno Drainer clone and 100+ protocols were exposed (Celer blocked its takeover via domain monitoring). Ambient Finance's domain was hijacked through stolen registrar credentials on October 17, 2024. Most recently, on April 14, 2026 attackers used forged identity documents to social-engineer the registrar into handing over DNS control of CoW Swap's swap.cow.fi and cow.fi domains, redirecting users to a pixel-perfect drainer clone for about 90 minutes; over $1M was taken in roughly three hours, including 219 ETH (~$750K) from a single wallet, while CoW's contracts, backend APIs, and solver network were untouched. The same bucket includes CDN-account injections (KyberSwap's September 2022 Cloudflare/Google Tag Manager compromise, ~$265K) and BGP route hijacks that swap signed bundles for drainer code.