Digital Asset
Intelligence
Security Incident · Bridge

Stake DAO Smart Contract Vulnerability: $176.00K Reported Loss

·Historical incident record

Incident Overview

Stake DAO’s Votemarket module was exploited. The attacker used a vulnerability in the L1BlockOracleUpdater peripheral contract to inject fabricated L1 block data via the LaPoste cross-chain bridge, poisoning the oracle and forging vote proofs to drain ~$176,000 in campaign incentive rewards across 54 campaigns. The incident was later resolved as a white-hat event with most funds recovered.

Sources & References

Original incident referencehttps://x.com/StakeDAOHQ/status/2036029009054642461 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Stake DAO

    Attack methodPrivate Key Leakage
    Reported loss$ 91,000
  2. Incident date
    Target

    Kelp DAO

    Attack methodSupply Chain Attack
    Reported loss$ 293,000,000
  3. Incident date
    Attack methodSmart Contract Vulnerability
    Reported loss$ 3,000,000
  4. Incident date
    Attack methodReserve Manipulation Attack
    Reported loss$ 131,000
  5. Incident date
    Target

    BONKfun

    Attack methodDomain Hijacking
    Reported loss$ 30,000