TrustedVolumes exploit analysis
TrustedVolumes credited user rewards from a caller-supplied volume report. DeFiHackLabs reconstructs the credit-and-claim sequence against the on-chain behaviour.
- Reported loss
- ~$5.87M, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-07: Signature Replay on TrustedVolumes”.
Analysis1 min read
TrustedVolumes accepted external volume reports and credited user rewards against a caller-supplied report. The attacker called the volume-report acceptance with a forged report and harvested the credit.
DeFiHackLabs reconstructs the sequence against the live Ethereum state. The PoC reads the vulnerability from the on-chain behaviour because the source is unverified.
What would have prevented it: a volume-report path that requires a signature from a trusted oracle key, or one that bounds reward credit to a known-volume cap.
Other exploits
- HumaFinance exploit analysis 11 May 2026
- INKFinance exploit analysis 11 May 2026
- Renegade exploit analysis 10 May 2026
- Ekubo exploit analysis 5 May 2026
- SharwaMarginTrading exploit analysis 1 May 2026
- JUDAO exploit analysis 28 Apr 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
