AROS exploit analysis
AROS's router-skim path paid the caller the pair's WBNB surplus at an inflated AROS reserve. DeFiHackLabs reconstructs about $295K drained on BNB Chain.
- Reported loss
- ~$295K, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-30: Signature Replay on AROS”.
Analysis1 min read
AROS's token contract carried a skim window on the AROS/WBNB pair that, when called by a router, paid the caller the pair's WBNB surplus. The attacker flash-loaned WBNB, performed a series of swaps that inflated the AROS reserve to a point where the router-skim path returned the pair's WBNB balance.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; the drain is in 0xe89fe640ec5241edfca7d8dcae77a0a4270dee15e4bbd043fc60e393aabf41e1 on BscScan for a total loss of about $295K. TenArmorAlert reported the incident.
What would have prevented it: removing the public skim path from the AROS pair, or restricting the skim reward to the deployer.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260530-aros---pair-skim--reserve-mismatch-exploit-flash-swap-leveraged
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/AROS_exp.sol
- https://bscscan.com/tx/0xe89fe640ec5241edfca7d8dcae77a0a4270dee15e4bbd043fc60e393aabf41e1
Other exploits
- ATM Token exploit analysis 4 Jun 2026
- BYToken exploit analysis 4 Jun 2026
- The Kiss exploit analysis 2 Jun 2026
- Gravity Bridge exploit analysis $5.4M
- DxSale exploit analysis $7.3M
- YSDAO exploit analysis 29 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
