PerpPair exploit analysis
PerpPair applied a funding update against a same-block caller-supplied `oraclePrice`. DeFiHackLabs reconstructs the funding-manipulation drain against the on-chain behaviour.
- Reported loss
- 165K USDC, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-05: Virtual Amm Manipulation on PerpPair”.
Analysis1 min read
PerpPair's funding-rate update was applied against an oraclePrice argument that the attacker had updated in the same block via a public function. The funding payment was debited against the long side and credited to the short side, and the attacker shorted into the manipulated funding.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a funding-rate computation priced against a multi-block oracle, not a same-block caller-supplied price.
Other exploits
- Saturn Protocol exploit analysis 14 Apr 2026
- SubQuerySettings exploit analysis 12 Apr 2026
- SquidMulticallAllowanceDrain exploit analysis 7 Apr 2026
- WhalebitOracleManipulation exploit analysis 31 Mar 2026
- VTSwapHook exploit analysis 28 Mar 2026
- EST Token exploit analysis 27 Mar 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
