XocolatlLiquidator exploit analysis
XocolatlLiquidator's `liquidate(debtor)` accepted any caller's debtor, so the attacker walked arbitrary collateral out. DeFiHackLabs reconstructs the on-chain drain.
- Reported loss
- 3.25 cbETH and 0.22 WETH, per DeFiHackLabs
- Occurred
- Logged
- Source
- DeFiHackLabs
Logged as “2026-03-24: Access Control Input Validation on XocolatlLiquidator”.
Analysis1 min read
XocolatlLiquidator's liquidate(debtor) accepted the debtor argument from the caller and credited the caller with the debtor's collateral. The attacker supplied any debtor and walked the collateral out.
DeFiHackLabs reconstructs the sequence against the live state; total loss is captured in the PoC.
What would have prevented it: a liquidator keyed to a single debtor at a time, with the debtor's debt balance required to be unhealthy on a TWAP-protected oracle.
Other exploits
- VTSwapHook exploit analysis 28 Mar 2026
- EST Token exploit analysis 27 Mar 2026
- Univ3CollateralToken exploit analysis 24 Mar 2026
- BCE exploit analysis 23 Mar 2026
- ATMBlindBox exploit analysis 19 Mar 2026
- Revamp exploit analysis 19 Mar 2026
Query every incident yourself — free, no signup
Updated 14 Oct 2026. Figures are as reported by the sources listed above and are not independently verified.
The crypto data layer for humans, apps, and AI agents.
