PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

The Phantom Deposit: How Unvested Rewards and Empty Vaults Lead to Yield Theft in ERC4626

hackenproof.com | research | #bug-bounty | #web3 | #vulnerability-research | #smart-contracts | #defi | #erc4626 | #vault-accounting | #yield-theft
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

A guest deep-dive into ERC4626 vault accounting: how unvested rewards combined with a zero-supply state — the 'phantom deposit' — can be gamed to steal yield, from a confidential bounty find.
Published
Collected

Related coverage

research · github.com
Steal My Bitcoin Challenge Writeup: PHP 8.4.26 Session Upload Progress Memory Exhaustion Analysis
Provides a detailed binary-level case study on PHP Zend memory manager behavior and worker state persistence after fatal out-of-memory errors.
research · projectdiscovery.io
PHP2Shell: finding and patching affected PHP
Two CVSS 9.2 bugs in the PHP runtime allow unauthenticated code execution; the patch is a package upgrade and a restart, and this guide shows how to find every PHP runtime you need to patch.
blog · hackenproof.com
Aptos Move Smart Contract Security: How Object Refs Leak and Global Storage Breaks
Unchecked borrow_global_mut, leaked object refs, and Block-STM races break Aptos protocols. See the $25.5M Thala exploit and an Aptos/Supra audit checklist.
blog · hackenproof.com
1inch Bug Bounty Report: Aqua Edition, H1 2026
This report highlights common smart contract and DeFi logic vulnerabilities discovered through crowdsourced security testing.
blog · hackenproof.com
DeFi Lending Protocols: Attack Vectors and How to Secure Them
How DeFi lending protocols work, the attack vectors behind recent exploits like Kelp-Aave and Tectonic, and the controls that keep lending markets secure.
blog · hackenproof.com
Maiar DEX went offline. Bug in Elrond smart contract a reason
Analysis of the Maiar DEX exploit: a callback flaw in Elrond's new VM function let an attacker drain over 1.6M EGLD, forcing an emergency shutdown and a 95% price crash in half an hour.
Back