FractalProtocol exploit analysis
FractalProtocol's `redeem(fee)` accepted a caller-supplied fee, and a negative-fee shape credited the caller with the LP while the contract paid out the pool's reserve. DeFiHackLabs reconstructs about $13.7K drained on Arbitrum.
- Reported loss
- ~$13.7K, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-22: Business Logic Flaw on FractalProtocol”.
Analysis1 min read
FractalProtocol's redeem accepted a fee argument from the caller without a minimum and credited the redemption to a value derived from the LP token's balanceOf. The attacker called redeem with a negative-fee shape that the contract accepted as a fee credit, walked the LP out against the pool's claimed reserve, and exited with the spread.
DeFiHackLabs reconstructs the sequence against the live Arbitrum state; the drain is in 0x20db78913a51c3b3aece860ea142c240f3f8fa3b5bbf533a3d1d48eed857e10f on Arbiscan for a total loss of about $13.7K. Defimon Alerts reported the incident.
What would have prevented it: a minimum fee parameter on redeem, or a fee calculated against an oracle price rather than a caller-supplied value.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260522-fractalprotocol---redeem-accepts-caller-supplied-negative-fee
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-05/FractalProtocol_exp.sol
- https://arbiscan.io/tx/0x20db78913a51c3b3aece860ea142c240f3f8fa3b5bbf533a3d1d48eed857e10f
Other exploits
- New Market Trading exploit analysis 25 May 2026
- SquidRouterModule exploit analysis 25 May 2026
- WUSD.fi exploit analysis 25 May 2026
- MureDistribution exploit analysis 21 May 2026
- MAPProtocol exploit analysis 20 May 2026
- ElevateFi exploit analysis 19 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
