OceanBPoolSideStaking exploit analysis
Ocean BPool's join/exit is asymmetric, and SideStaking mirrored every single-sided mOCEAN join/exit with a datatoken stake/unstake, so repeated single-sided BPT moves returned more mOCEAN than they deposited. DeFiHackLabs reconstructs about 127,860 mOCEAN across eight victim BPool positions on Polygon.
- Reported loss
- 127.86K mOCEAN, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-06-25: Bpool Single Sided Joinexit Math With Sidestaking Gulp Accounting on OceanBPoolSideStaking”.
Analysis1 min read
Ocean BPool's join and exit math is asymmetric: a single-sided join credits fewer BPT to the caller than a corresponding single-sided exit returns in the underlying. SideStaking mirrored each single-sided BPT join/exit with a datatoken stake/unstake that returned the underlying to the BPT caller. The composite join then returned more mOCEAN than was deposited.
The attacker at 0x3fa8cf7fea68c8e76a9838d77889464ddfb6a6cf flashed mOCEAN, repeatedly joined via max single-sided mOCEAN into the targeted BPool pools against the historical attack contract 0xdd4bfd70117b5b6b343fc8d2c8c0075d095dbee5, and exited BPT back to mOCEAN at the asymmetric ratio.
DeFiHackLabs reports a total drained of about 127,860 mOCEAN. The drain is in 0x6dc8a7fba1303faef3ec7afa770b90b17ec5ecd73b51229277a9b0492e285796 on Polygonscan. Eight BPool victim positions on Polygon are affected.
What would have prevented it: SideStaking ought to ignore single-sided BPT moves or compute the datatoken delta from the actual mOCEAN price delta rather than mirroring the BPT leg. Asymmetric BPT join/exit math catches price-impact fees that a mirroring contract has no reason to claim.
Sources read (3)
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/README.md#20260625-oceanbpoolsidestaking---bpool-single-sided-joinexit-math-with-sidestaking-gulp-accounting
- https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2026-06/OceanBPoolSideStaking_exp.sol
- https://polygonscan.com/tx/0x6dc8a7fba1303faef3ec7afa770b90b17ec5ecd73b51229277a9b0492e285796
Other exploits
- AIDC exploit analysis 28 Jun 2026
- CookFinanceIssuance exploit analysis 27 Jun 2026
- LixirPermitDrain exploit analysis 25 Jun 2026
- Polymarket exploit analysis $3.0M
- DLMC exploit analysis 24 Jun 2026
- RoyalRoyalties exploit analysis 23 Jun 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
