OAK — OnChain Attack Knowledge

Tactic · OAK-T9 · Realization

OAK-T9 — Smart-Contract Exploit

Phase
Realization
Adjacent tactics
T5 (Value Extraction — when the exploit yields direct value), T7 (Laundering)

Scope

Smart-Contract Exploit covers cases where the value-extraction event is enabled by a protocol-layer bug or design flaw in the targeted contract — not by social engineering, market manipulation against a properly-functioning protocol, or operator-controlled-rug behaviour. T9 is the largest single class of public losses in DeFi by aggregate dollar value, with [zhou2023sok] documenting at least $3.24B in losses across the 2018–2022 window and many subsequent incidents pushing the cumulative figure substantially higher.

Within OAK, T9 is complementary to T1–T8: a T9 incident attacks the protocol; a T1–T8 chain attacks holders of a token deployed by the operator. The two often co-occur in the same incident (a T9 oracle manipulation may be enabled by a T9.002 flash-loan precondition; T9 proceeds usually flow into a T7 laundering chain), but the predicate behaviour is different.

What defenders observe

  • Single-transaction extraction events whose mechanism is tied to a specific contract's logic rather than to operator-controlled outflows.
  • Pre-event signals that involve flash-loan setup, oracle-input manipulation, governance-vote acquisition, or interaction with administrative roles, rather than the LP-control / authority-grant signals that drive T1–T8.
  • Post-event, the affected protocol typically pauses or hot-patches; legitimate users may be made whole through treasury / insurance-fund mechanisms or, in regulated cases, through judicial remedies.

Relationship to other tactics

T9 is the operator-independent analogue of T5: instead of "the deployer drained the LP they controlled", T9 is "an attacker exploited a flaw in a deployed protocol's logic". Because T9 attacks the protocol rather than the holders, OAK's defender-perspective framing differs from T1–T8: detection at T9 lives at the protocol layer (audit, monitoring, oracle-resilience review) rather than at the holder layer (pre-trade risk assessment).

Techniques in this Tactic (v0.1)

Maintainer notes

T9 in v0.1 covers five high-frequency Technique classes. Reentrancy (T9.005) is in scope because the modern variants — cross-function, cross-protocol (Cream Finance Oct 2021), hook-based (Lendf.Me Apr 2020), and read-only (Curve Jul 2023) — recur in incident data despite the maturity of ReentrancyGuard and checks-effects-interactions discipline. Integer over/underflow remains out of scope at v0.1 (Solidity ≥0.8 default checked arithmetic substantially closes the class at the library level; the most consequential historical incidents — The DAO 2016 is reentrancy not overflow, batch-overflow tokens 2018 — are well-documented in [zhou2023sok] and OWASP SC Top 10 [owaspscstop10]). v0.x updates may add overflow if a contemporary cohort warrants reopening the class.

Techniques (20)