Digital Asset
Intelligence
Security Incident · ETH Ecosystem

XCarnival Contract Vulnerability

·Historical incident record

Incident Overview

The NFT liquidity solver XCarnival was attacked, the hacker made a profit of 3,087 ETH (about 3.8 million US dollars), and the hacker has returned 1,467 ETH after the negotiation. The core of this vulnerability is that when borrowing, there is no judgment on whether the NFT in the order has been withdrawn.

Sources & References

Original incident referencehttps://twitter.com/XCarnival_Lab/status/1541060630748479488 (opens in a new tab)

This record presents information attributed to the linked sources. Incident dates describe the original event, not a new report. Reported loss figures reflect the source record and are not current market valuations.

More Security Incidents

View All →
  1. Incident date
    Target

    Harmony

    Attack methodPrivate Key Leakage
    Reported loss$ 100,000,000
  2. Incident date
    Target

    Quixotic

    Attack methodContract Vulnerability
    Reported loss220,000 OP
  3. Incident date
    Target

    SNOOD

    Attack methodReentrancy Attack
    Reported loss104 ETH
  4. Incident date
    Target

    Quint

    Attack methodContract Vulnerability
    Reported loss$ 130,000
  5. Incident date
    Attack methodDNS Attack
    Reported loss215 ETH