Account-Delegation and Reserve-Manipulation Exploits Fill the Latest DeFi Attack Ledger

Overnight the security repository DeFiHackLabs added working reproductions of three recent attacks. Each vector is worth naming, because each maps to a known class of failure.

The first drained the MOKE token through an unprotected claim function reached via EIP-7702 self-delegation. Ethereum Improvement Proposal 7702 (EIP-7702) lets an ordinary wallet address temporarily execute contract code. When a distribution function checks only that the caller appears to be a contract, or fails to check who the caller is at all, delegation lets an attacker use that missing access control to withdraw tokens. Security firms have already documented more than 97 percent of observed EIP-7702 delegations pointing at wallet-draining contracts, so the standard's abuse surface is established rather than theoretical.

The second reproduction covers an AIC trading-pair skim and reserve-mismatch attack financed by a flash swap. The pattern is the same one DARKNAVY documented on BNB Chain in June, where a token transfer bug let an attacker use the pool's own skim and sync functions to zero out a reserve and change the reported price before selling into a second pool. The third, against LpdFi, is spot-price manipulation combined with an issue-boundary error, meaning the protocol priced an asset from a pool an attacker could move within a single transaction.

The larger sums this cycle came from key and validator compromise rather than contract logic. Rekt News case files cover AFX Trade, a perpetuals venue on Arbitrum drained of $24.15 million in USDC after five hot validator signatures on its custody bridge were compromised, which bypassed the quorum requirement. The files also cover VerusCoin's Ethereum bridge, where an attacker used the import path to trigger payouts of roughly $7.54 million that no reserves backed. Ostium, another Arbitrum perpetuals venue, lost funds when an attacker fed its custom price layer a bitcoin price of $5,000 to open a position and closed it near $60,000. None of these protocols has reported recovered funds or an identified attacker.