GiddyVaultV3 exploit analysis
GiddyVaultV3's `redeem` rounded the payout in the caller's favour, so the attacker accumulated the rounding error over many `redeem`s. DeFiHackLabs reconstructs the rounding-skim drain.
- Reported loss
- $1.3M, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-23: Incomplete Signature Coverage on GiddyVaultV3”.
Analysis1 min read
GiddyVaultV3's redeem ignored the dust balance the caller held and paid out the recorded balance directly, with a rounding error that the attacker exploited. Each redeem returned slightly more than the caller had recorded, accumulating over many calls into the vault's float.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a redeem whose payout rounds the rounding error back to the vault rather than the caller.
Other exploits
- RWAVault exploit analysis 28 Apr 2026
- Unverified_a152 exploit analysis 27 Apr 2026
- SingularityDynaVault exploit analysis 25 Apr 2026
- KipseliPropAMM exploit analysis 21 Apr 2026
- JuiceboxREVLoans exploit analysis 20 Apr 2026
- ThetanutsVaultShareRounding exploit analysis 20 Apr 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
