RWAVault exploit analysis
RWAVault's `refresh` read a price that any caller could update through a public `updatePrice()`. DeFiHackLabs reconstructs the in-tx refresh-and-borrow against the on-chain behaviour.
- Reported loss
- 398,655.47 USDC, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-28: Missing Erc4626 Allowance Check on RWAVault”.
Analysis1 min read
RWAVault's refresh accepted an oracle price that the same caller had updated via a public updatePrice function with no access control. The attacker updated the price to a manipulated value and called refresh against it, walking the inflated collateral out.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a refresh that reads from a TWAP-protected oracle and rejects single-block price updates as a price source.
Other exploits
- Ekubo exploit analysis 5 May 2026
- SharwaMarginTrading exploit analysis 1 May 2026
- JUDAO exploit analysis 28 Apr 2026
- Unverified_a152 exploit analysis 27 Apr 2026
- SingularityDynaVault exploit analysis 25 Apr 2026
- GiddyVaultV3 exploit analysis 23 Apr 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
