SingularityDynaVault exploit analysis
SingularityDynaVault priced a deposit at the pre-rebase ratio and a withdrawal at the post-rebase ratio, allowing the attacker to walk the difference. DeFiHackLabs reconstructs the on-chain drain.
- Reported loss
- 413.13K USDC, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-25: Oracle Misconfiguration Share Inflation on SingularityDynaVault”.
Analysis1 min read
SingularityDynaVault's deposit credited shares at the live totalAssets() / totalSupply() ratio, and a withdrawal redeemed at the same ratio. A rebase() step that the contract did not guard against could push the ratio up between the caller's deposit and the caller's withdrawal in the same block, allowing the attacker to mint a small position and withdraw against an inflated ratio.
DeFiHackLabs reconstructs the sequence against the live state; the PoC reads the vulnerability from the on-chain behaviour.
What would have prevented it: a withdrawal that prices against a prior block's ratio rather than the live one.
Other exploits
- JUDAO exploit analysis 28 Apr 2026
- RWAVault exploit analysis 28 Apr 2026
- Unverified_a152 exploit analysis 27 Apr 2026
- GiddyVaultV3 exploit analysis 23 Apr 2026
- KipseliPropAMM exploit analysis 21 Apr 2026
- JuiceboxREVLoans exploit analysis 20 Apr 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
