Anatomy of a DeFi Hack: How Protocols Get Exploited (and What to Learn)

Over $3 billion has been stolen from DeFi protocols. Understanding how these exploits work isn't morbid curiosity - it's the prerequisite for building systems that don't get exploited.

The most important lesson: almost every major exploit was preventable with known techniques. The failures were in implementation, not in fundamental limitations of blockchain security.

Re-entrancy: the original DeFi vulnerability

The DAO hack (2016, $60M in ETH) exploited re-entrancy. The pattern:

1. Attacker calls `withdraw(amount)` on the victim contract
2. Contract sends ETH to attacker before updating the state
3. Attacker's receiving function (fallback) immediately calls `withdraw(amount)` again
4. State hasn't been updated yet - the contract thinks the attacker hasn't withdrawn
5. Repeat until the contract is drained

Prevention: update state before making external calls (Checks-Effects-Interactions pattern), or use a re-entrancy guard (mutex lock). These patterns have been standard for 8 years. Contracts still get exploited by re-entrancy through more complex paths: cross-contract re-entrancy, read-only re-entrancy, ERC-777 re-entrancy.

Read-only re-entrancy (exploited against Curve in 2023, $70M targeted): even view functions can be exploited if they're called during a re-entrant state. A price oracle that reads a pool's state while the pool is mid-execution can see a momentarily distorted price.

Oracle manipulation: the billion-dollar attack vector

If a protocol prices assets using a single DEX's spot price, a flash loan can manipulate that price momentarily. Exploit pattern:

1. Flash loan $100M of ETH
2. Dump on Uniswap, crashing ETH price in that pool
3. Protocol reads the manipulated price, triggers mass liquidations of ETH positions
4. Attacker buys the liquidated ETH below market price
5. Repay flash loan, keep the profit

Mitigations: TWAP prices (require sustained manipulation over many blocks), multi-source aggregation (Chainlink with 50+ sources), staleness checks (don't use price data more than X seconds old), circuit breakers (halt if price moves >X% in a single block).

Logic bugs: the underappreciated category

Many of the largest hacks weren't exploits of cryptography or smart contract mechanisms - they were logic bugs. Wormhole ($325M): a bug in Solana signature verification that allowed an attacker to fake a valid guardian signature and mint wrapped ETH out of thin air. The validator check had a flaw in how it handled Solana's sysvar accounts.

Nomad ($190M): a misconfiguration during a routine upgrade caused the contract to treat an all-zero Merkle proof as valid. This meant any message could be "proven" valid. Once one attacker noticed and published the method, hundreds of copycats drained the bridge within hours.

Euler Finance ($197M): a flash loan exploit that exploited the interaction between Euler's donation function and its liquidation mechanics. The attacker could create a "self-liquidation" that generated more value than was deposited.

In each case, the exploit was understandable in hindsight and could have been caught by formal verification, comprehensive testing, or invariant checking. The protocols weren't undone by impossible attacks - they were undone by bugs that thorough auditing should have caught.

Key principles from the exploit postmortems

Simulate before sign: every autonomous operation should be simulated in a forked state before the real transaction is submitted. If the simulation fails or produces unexpected outputs, abort.

Circuit breakers: time-delayed execution for large operations, rate limits on withdrawals, kill-switches that halt the system without blocking withdrawals. A well-designed kill-switch is the cheapest insurance.

Formal invariants: write down what must always be true. Total assets in the vault must always equal total shares × share price. The system must never have liabilities exceeding assets. Check these invariants in every test.

Minimal privilege: session keys can only call specific functions. No admin key that can arbitrarily withdraw funds. Upgradeability behind timelocks.

At Morca Labs, these lessons are embedded in Tasmil's engineering PRD as cross-cutting invariants - simulate-before-sign, oracle discipline, audit bus, least-privilege session keys. They're not features; they're requirements.