Rounding Bug Drains a Legacy Set Protocol Vault as Losses Spread From Contract Code to Hot Wallets and Bridges

The latest reconstruction in the DeFiHackLabs repository covers ETHMACOAPY, a legacy Set Protocol vault on Ethereum. The vault lost about 8.11 WETH across two attacks on October 6. The flaw is a rounding bug. Anyone can call the actualizeFee() function, with no owner or role check. The function recalculates the vault's stored share value using division that rounds up. The attacker deposited funds, donated extra collateral to widen the rounding error, triggered the recalculation, and then redeemed more collateral than they had put in. The difference came out of other holders' reserves. No freeze or recovery has been reported. The case adds to a pattern of attacks on deprecated contracts that teams stopped maintaining but never shut off.

NEAR Intents, a cross-chain trading service, lost $3.8 million on October 1. A bug in how its smart contract interacted with Omni's custody system allowed unauthorized withdrawals from a hot wallet on BNB Chain. Deposits and withdrawals were restricted on 11 networks. Illia Polosukhin, a NEAR co-founder, said the attacker returned the money about a day after the team made contact, and that users will be reimbursed in full. Rekt News has written up the incident.

The Nomic case shows how slowly bridge failures can come to light. An attacker combined two bugs in Nomic's custom forwarding mechanism to double-spend nBTC, Nomic's wrapped bitcoin token. That created 40.65 BTC of claims with no bitcoin behind them, and the attacker sent them to Osmosis on June 25. Osmosis took 74 days to notice. By then, 39.84 of those unbacked nBTC made up about 36% of the backing of Alloyed BTC. Osmosis validators then ran an emergency upgrade that froze 22.65 BTC at the attacker's address.

The largest losses in recent months came from operational infrastructure. Bitget lost $387.5 million from hot and warm wallets after attackers used zero-day exploits on two third-party security appliances to reach its wallet system, according to investigations by SlowMist and Mandiant reported by BleepingComputer. BeInCrypto calls it the year's largest theft. The crypto casino Duelbits lost about $7 million in a suspected compromise of hot-wallet private keys on several chains. Nostra, a lending market, lost $3.5 million to oracle manipulation. SingularityNET reported that an attacker accessed its cloud infrastructure. Rekt News has covered all of these.