JUDAO exploit analysis
JUDAO's `withdraw` did not update `stakedSupply` in the same call, so the attacker double-withdrew against the same recorded stake. DeFiHackLabs reconstructs the on-chain drain.
- Reported loss
- 205K USDT + 36 BNB, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-28: Judao Sell Hook Reserve Drain on JUDAO”.
Analysis1 min read
JUDAO's staking withdraw checked the caller's recorded stake against the contract's stakedSupply, but stakedSupply was not updated synchronously with the withdraw call. The attacker withdraw against the same balance before the supply updated, then withdrew again.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a withdraw that debits the recorded stake and re-reads stakedSupply after the debit, in a single locked call.
Other exploits
- TrustedVolumes exploit analysis 7 May 2026
- Ekubo exploit analysis 5 May 2026
- SharwaMarginTrading exploit analysis 1 May 2026
- RWAVault exploit analysis 28 Apr 2026
- Unverified_a152 exploit analysis 27 Apr 2026
- SingularityDynaVault exploit analysis 25 Apr 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
