WUSD.fi exploit analysis
WUSD.fi's `wrap()` read the caller's GLOVE balance at wrap-time, so an attacker could transfer GLOVE in just before wrapping to inflate the reward accounting. DeFiHackLabs reconstructs about $200K (USDC plus USDT) drained from Uniswap V3 GLO pools.
- Reported loss
- ~$200K USD (GLOVE emissions + LP drain), per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-05-25: _Englove Sybil Incentive Abuse on WUSD.fi”.
Analysis1 min read
WUSD.fi's wrap() paid a GLOVE reward via the internal _englove() routine, which computed gloves as the caller's GLOVE.balanceOf(msg.sender) at wrap time. Because the caller's GLOVE balance was not snapshotted against the wrap's underlying collateral, an attacker could inflate the recorded GLOVE reward by transferring GLOVE to the caller just before the wrap.
DeFiHackLabs reconstructs the sequence against the live BNB Chain state; total loss is approximately $200K USD (USDC plus USDT drained from Uniswap V3 GLO pools).
What would have prevented it: a snapshot of the GLOVE balance at wrap-time that cannot be inflated in the same transaction.
Other exploits
- SKP Token exploit analysis 26 May 2026
- New Market Trading exploit analysis 25 May 2026
- SquidRouterModule exploit analysis 25 May 2026
- FractalProtocol exploit analysis 22 May 2026
- MureDistribution exploit analysis 21 May 2026
- MAPProtocol exploit analysis 20 May 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
