SubQuerySettings exploit analysis
SubQuerySettings' `updateFee` accepted any caller-supplied fee, so the attacker inflated the fee, drained a fixed-price withdrawal, then restored the original. DeFiHackLabs reconstructs the drain.
- Reported loss
- 218.07M SQT, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-04-12: Settings Access Control on SubQuerySettings”.
Analysis1 min read
SubQuerySettings' updateFee accepted a fee argument with no upper bound. The attacker called updateFee against a high fee, drained a fixed-price withdrawal against the inflated fee, then restored the original fee.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: an updateFee path with an upper-bound check, or any fee change that requires a timelock.
Other exploits
- XLootStaking exploit analysis 15 Apr 2026
- MONA LisaVault exploit analysis 14 Apr 2026
- Saturn Protocol exploit analysis 14 Apr 2026
- SquidMulticallAllowanceDrain exploit analysis 7 Apr 2026
- PerpPair exploit analysis 5 Apr 2026
- WhalebitOracleManipulation exploit analysis 31 Mar 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
