AmbientCrocSwapDex exploit analysis
AmbientCrocSwapDex quoted native surplus into the LP token's `totalAssets()` while the redeem path paid the surplus back. DeFiHackLabs reconstructs about 67.85 ETH drained on Ethereum.
- Reported loss
- 67.85 ETH, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-06-07: Native Surplus Accounting Flaw on AmbientCrocSwapDex”.
Analysis1 min read
AmbientCrocSwapDex's native-surplus accounting credited the pool with the protocol's overhead-native balance as part of an LP-side fee, but the user's redeem path read that same balance as if it were available inside the LP token. A call sequence let the attacker push the surplus into the LP token's reported totalAssets and withdraw it.
DeFiHackLabs reconstructs the sequence against the live Ethereum state; the drain is in 0xb2fc668c42623261074de6fc30d583efede2b0e20d7aded42b7b634f9322ff52 on Etherscan, giving a net loss of about 67.85 ETH after the final USDC->WETH conversion and ETH forwarding. TenArmorAlert reported the incident.
What would have prevented it: removing native surplus from totalAssets(), or having the redeem path make explicit accounting for which asset is being paid out.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260607-ambientcrocswapdex---native-surplus-accounting-flaw
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/AmbientCrocSwapDex_exp.sol
- https://etherscan.io/tx/0xb2fc668c42623261074de6fc30d583efede2b0e20d7aded42b7b634f9322ff52
Other exploits
- Humanity Protocol exploit analysis $36M
- NovaBox exploit analysis 9 Jun 2026
- TOPBPool exploit analysis 9 Jun 2026
- BOSS exploit analysis 6 Jun 2026
- AISOTHPresale exploit analysis 5 Jun 2026
- DTXT exploit analysis 5 Jun 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
