Audited DeFi protocols lost $885M to attacks that occurred completely outside their audit scopes
In decentralized finance, “audited” is commonly offered as a verdict on a complete undertaking. In observe, an audit normally covers named code, parts and variations at a specific cut-off date. Anything added, excluded or operated round that boundary could carry a distinct stage of assurance.
A brand new preprint places a quantity on that hole. Researchers affiliated with safety firm ack3 and the Czech Technical University in Prague examined 135 reported incidents from the first half of 2026, with $939.86 million in attributed losses. They discovered identifiable public pre-incident audits for 68 incidents.
Within that 68-incident subset, the authors categorized 46 assault paths as outside each audit scope they might determine, 20 as inside a minimum of one scope and two as unresolved. The outside-scope group represented 67.6% of the incidents however 94.4% of their reported losses.
That placing proportion isn’t an estimate of audit effectiveness or proof that an audit’s boundaries precipitated a loss. It describes the distribution of losses in a particular set of reported incidents. Two giant circumstances additionally dominate it: after excluding $292 million at Kelp DAO and $285 million at Drift Protocol, the outside-scope share falls to 72.1% of losses in the identical audited-incident subset.
Even with these limits, the examine exposes a fundamental assurance drawback. A undertaking could in truth say it was audited whereas leaving customers unable to inform whether or not the dwell system, the trail holding their funds and the controls round it have been reviewed.
What the info really exhibits
The ack3 dataset covers incidents from Jan. 1 by June 29. Its authors graded 122 as confirmed and 13 as possible. Of the total set, 35 had no recognized audit and 32 had an unknown audit historical past, so neither group seems within the 68-incident scope calculation.
For that 68-incident group, outside-scope incidents accounted for $680.97 million of $721.24 million in reported losses, producing the 94.4% determine. Removing Kelp DAO and Drift Protocol left $103.97 million of $144.24 million outside scope, or 72.1%. The machine-readable ledger reproduces the bucket counts and loss sums.
The inside-or-outside labels stay the researchers’ judgments about public proof. They searched undertaking and auditor archives, positioned pre-incident experiences and in contrast the eventual assault paths with reviewed code, variations and exclusions. The work is a six-page preprint produced with the dataset writer, and two authors are affiliated with ack3, which sells safety critiques.
The examine additionally lacks an unexploited comparability group and a measure of how lengthy every system was uncovered. It can’t set up whether or not audited protocols are safer general, estimate incident likelihood or present that falling outside scope precipitated every loss. Undisclosed audits and personal incidents could also be lacking, whereas reported loss figures will not be completely comparable.
The examine due to this fact helps a restricted conclusion: audit historical past and audit scope are completely different variables. A reviewed sensible contract doesn’t routinely confer the identical assurance on an improve, privileged key, entrance finish, relayer, oracle, cloud service or incident-response course of.
Two incidents from August illustrate that distinction in numerous methods. ICON Network supplies a direct instance of reviewed code failing on the boundary between two checks. The August aelf incident supplies a contrasting case as a result of the out there audit proof can’t but be tied to its reported runtime path.
In ICON Network’s Aug. 27 replay exploit, two elements of a withdrawal path interpreted the identical message in a different way.
According to the ICON Foundation’s Aug. 30 postmortem, a migration contract used the high bits of a withdrawal message’s serial quantity to determine whether or not it was distinctive. The cryptographic signature lined solely the low 256 bits. By altering the unsigned high bits, an attacker resubmitted two legitimately signed withdrawal messages 1,492 instances over about 20 minutes. ICON stated 1,490 calls succeeded.
The audited boundary ICON missed
The replays launched 119.866 million ICX and 531,600 bnUSD. At the time of the postmortem, ICON put the confirmed web loss at about 150.2 ETH plus 31,204 USDC. It stated 531,600 bnUSD and 1.366 million SODA had been recovered and that person deposits, balances and positions weren’t affected.
ICON stated the migration contract had undergone an exterior audit and that suggestions had been applied, together with modifications in the identical space. It additionally stated the related relay logic obtained a devoted overview. The SODAX audit archive lists eight experiences throughout completely different parts, together with a November 2025 relay audit.
Yet the postmortem stated the exact mismatch between the individuality test and the signed worth fell outside these findings. A project-level badge couldn’t inform a person whether or not each ends of the withdrawal path agreed on what made a message distinctive.
The response timeline provides a second form of boundary. ICON’s first automated alert fired at 02:08 UTC, about seven minutes after the exploit started. Staff opened an investigation round 03:40, paused the affected contract at 03:53 and halted the community at 06:18:54.
ICON attributed the roughly 90-minute hole between the primary alert and a full incident response to alert tuning. The alert class had produced false positives throughout unrelated connectivity incidents and didn’t web page the on-call workforce on the wanted severity. The basis stated it deliberate an computerized shutdown set off, decrease circuit-breaker thresholds and a follow-up overview centered on message uniqueness and replay guards.
Those controls don’t exchange an audit. They present proof for a distinct query: when prevention fails, how rapidly can detection change into containment?
| Public assurance | The query customers nonetheless want answered |
|---|---|
| “Audited” | Which repository, commit, deployed tackle and part have been reviewed? |
| “Findings mounted” | Were the fixes deployed, and what modified afterward? |
| “Monitored” | Which alerts web page a human or cease the affected path routinely? |
| “Funds recovered” | Which property are confirmed recovered, frozen, uncovered or nonetheless beneath investigation? |
aelf exhibits why assurance should keep present
aelf’s August incident checks the argument from one other route. Its public file describes a runtime compromise and a managed restoration, however it doesn’t present sufficient proof to place the trail inside or outside a selected pre-incident audit.
The firm announced a network pause on Aug. 18. In its Aug. 26 progress update, aelf stated an unauthorized sensible contract might use transaction parameters to ship encoded .NET assemblies and directions into the node execution path.
The provisional account linked the incident to gaps in checks for runtime reflection and dynamic loading, along with weak isolation between contract execution and delicate node or infrastructure assets. aelf recognized 155 related transactions and 5 distinctive payload assemblies with capabilities together with host command execution, tried outbound communication, node-key entry and infrastructure reconnaissance.
Capability isn’t the identical as confirmed execution. aelf stated the payloads didn’t show that each meeting ran, that each focused credential was obtained or that delicate knowledge left its techniques. The firm stated it was rotating signing keys and infrastructure credentials beneath a potential-exposure customary.
The public standing remained provisional on Sept. 11: aelf’s blog index contained no incident-specific merchandise revealed after Aug. 26. The Aug. 26 assertion dedicated to one other replace and an eventual remaining overview.
aelf’s standing security documentation says its blockchain and ELF token contracts underwent a number of audits with no safety points recognized. But the out there pages don’t join a selected pre-incident report to the runtime path described in August. Calling the incident both an audit miss or an outside-scope failure would due to this fact outrun the proof.
That uncertainty is itself helpful. A dated audit historical past can change into indifferent from a system’s present code, dependencies and operational state. Users want an assurance file that is versioned and particular sufficient to reveal that drift.
Such a file ought to identify the reviewed repository and commit, deployed addresses, excluded parts, privileged roles and dependencies. It must also file upgrades since overview, key custody and rotation, runtime isolation, alert and circuit-breaker habits, and dated restoration standing that separates confirmed loss from frozen or unresolved publicity.
This doesn’t scale back the worth of an audit. It makes the declare proportional to the work carried out and connects that work to the system working now.
An audit badge can’t reply whether or not the reviewed artifact, the deployed system and the equipment that responds to failure nonetheless share the identical safety boundary.
The publish Audited DeFi protocols lost $885M to attacks that occurred completely outside their audit scopes appeared first on CryptoSlate.
