Revamp exploit analysis
Revamp's `claim(_amount, _token)` released the requested tokens without debiting the user's recorded balance. DeFiHackLabs reconstructs the on-chain reserve-drain.
- Reported loss
- 2.99 BNB, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-03-19: Reward Accounting Drain on Revamp”.
Analysis1 min read
Revamp's claim accepted an _amount parameter from the caller and released the corresponding _token from the contract's reserve, with the user's recorded balance not actually decremented. The attacker called claim(max, ...) to walk the entire reserve out.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a claim that decrements the user's recorded balance by the claimed amount in the same call.
Other exploits
- XocolatlLiquidator exploit analysis 24 Mar 2026
- BCE exploit analysis 23 Mar 2026
- ATMBlindBox exploit analysis 19 Mar 2026
- Fun.xyz CheckoutPool exploit analysis $86K
- StakeOnMe exploit analysis 15 Mar 2026
- Venus THE exploit analysis 15 Mar 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
