Exploit Operations Center

The TrustedVolumes RFQ proxy has a critically broken fill function. The EIP-712 signature commits to (makerToken, takerToken, makerAmount, takerAmount, maker, counterparty, expiry, salt), and the contract checks _allowedOrderSigner[signedMaker][recoveredSigner]. But the function also takes unsigned calldata that does the actual transfer - including the real from address, real token, and real amounts. Nothing binds the executed from to the signed maker.

Ekubo v2 locker blindly trusts the from address embedded in the locker's packed instruction payload. Its payCallback(token,id,_,amount,from) does a transferFrom with from taken straight from user-supplied calldata.

Defimon-style Telegram alert: Ekubo v2 locker trusted a user-supplied from address in packed lock instructions, allowing repeated WBTC drains from an approved EOA.

Sharwa's MarginTrading priced Hegic option NFT collateral via Uniswap V3's spot Quoter on a low-liquidity USDC.e/USDC pool with no TWAP or Chainlink fallback.

Defimon-style Telegram alert: Sharwa priced Hegic option NFT collateral from a low-liquidity Uniswap V3 spot quote without TWAP or Chainlink fallback.

The dynBaseUSDCv3 vault on Base prices its non-USDC reserves via UniswapV3Oracle. On 2026-01-19 the protocol admin registered the six yield-token oracle routes with a Uniswap V3 fee tier of 42. Uniswap V3 only enables fee tiers 100/500/3000/10000, so factory.getPool(USDC, X, 42) returns address(0) for every token - silently killing the direct price path. The WETH-fallback pools that did exist had zero liquidity, as a result VaultTokensLib.totalAssets() only counted the ~$100 idle USDC.

Defimon alert: dynBaseUSDCv3 vault on Base priced non-USDC reserves via UniswapV3Oracle. Admin registered yield-token routes with fee tier 42 (invalid) — factory.getPool returned address(0) for every token. Attacker flash-loaned 100k USDC, minted ~99.99% of supply at the broken ratio, then redeemed proportionally to drain all underlying yield tokens (~$413K).

Six-month social engineering campaign used Solana durable nonces, fake CVT collateral, and compromised contributor environments to drain $285M.

Phishing transactions abused Solana owner reassignment, giving attacker-controlled programs delayed control over victim accounts.

South Korea's largest exchange suffered abnormal Solana-asset withdrawals from internet-connected hot wallet infrastructure.

A targeted vault vulnerability allowed an attacker to steal approximately $2.2M from one Texture lending vault.

Oracle manipulation against RateX PT collateral enabled undercollateralized loans from Loopscale's USDC and SOL Genesis Vaults.

Hundreds of sub-threshold transactions drained hot wallets across Ethereum, TRON, Solana, and BSC before funds moved toward Tornado Cash.

Free demo case: NullTrace is investigating an ongoing TrustedVolumes resolver exploit on Ethereum. Instant forensic report is paid; full free report unlocks after 24 hours.