Solea Audit Academy

Our site has been newly launched. solea.academy/ You can find more details on the "About Us" tab.

Solea Audit Academy consists of three types of members: operators, full-stack developers (including AI and blockchain), and smart contract auditors. Our primary goal is to become the world's best audit group. What can a smart contract auditor do? 1. Low-Level Security We identify actual vulnerabilities from errors discovered by our AI auditing software. 2. High-Level Security Experienced auditors manually identify vulnerabilities. We classify them as Critical, High, Medium, and Low, and submit detailed reports to help clients understand and remediate them. We plan to introduce that system to automatically identify and recommend vulnerabilities. While we cannot guarantee 100% security, our experienced researchers will do their best to minimize security risks.

They've already received a lot of investment, so @noise_xyz will go to the moon soon, and if you participate here, you'll hit the jackpot.

Major Smart Contract Bugs Drained Hundreds of Millions in DeFi Hacks (2025) In 2025, while the majority of major cryptocurrency losses stemmed from private key compromises, phishing, and centralized exchange breaches (e.g., the $1.5B Bybit hack), smart contract bugs and vulnerabilities remained a significant issue in DeFi protocols. These accounted for roughly 8-11% of total hack losses, equating to approximately $263-325 million across various incidents. Improved auditing and security practices led to a relative decline in DeFi/smart contract exploits compared to prior years, but several high-profile cases highlighted persistent risks like logic flaws, overflow/underflow errors, reentrancy, rounding precision issues, and input validation failures. Here are some notable 2025 cryptocurrency hacking incidents specifically caused by smart contract bugs or vulnerabilities: - Cetus Protocol (May 2025): The largest pure smart contract exploit of the year. An arithmetic overflow bug in a shared math library (on the Sui blockchain) allowed attackers to inject spoof tokens, manipulate liquidity, and drain pools in under 15 minutes. Losses: ~$223 million. - Balancer (November 2025): Attackers exploited a rounding direction/precision error in V2 Composable Stable Pools, enabling repeated drains through chained transactions. Losses: ~$120-128 million (across Balancer and forks like Beets/Bex). - GMX V1 (July 2025): A reentrancy vulnerability (stemming from an unaudited 2022 patch) allowed manipulation of token prices and draining. Initially ~$42 million exposed (white-hat recovery in one case). - Abracadabra (Early 2025): Flash loan combined with a rounding vulnerability in lending contracts led to over-borrowing. Losses: ~$1.8-13 million (reports vary). - Mobius DAO (May 2025): Mathematical bug in minting function (double multiplication error in price data conversion). Part of a month with multiple contract flaws. - Other mentions: A March incident with a reentrancy bug in liquidity withdrawal (~$34 million); various smaller exploits involving lack of input validation, oracle manipulation via contract logic, or unchecked external calls. Overall, common root causes included: - Integer overflow/underflow - Reentrancy - Precision/rounding errors - Faulty input validation These underscore that even audited contracts can have overlooked edge cases, especially in complex DeFi interactions. Many protocols now emphasize multiple audits, bug bounties, and formal verification to mitigate such risks. If you're building or investing in DeFi, prioritizing projects with strong security track records is key.

Total: 3-10 days | From $800 | Public reports on GitHub. First 5 projects: 🎁 Heavy discounts + free if tiny! Who's launching soon? Be the first to apply! Reward: 10% commission for referrals. Let's grow the community! 🔥 github.com/Solea0 #SoleaAuditLab

YEARN FINANCE yETH EXPLOIT ANALYSIS Security Audit by Solea Audit Group EXPLOITER ADDRESS: 0xFb63aa935Cf0a003335dCE9Cca03c4F9c0fa4779 MAIN EXPLOIT TRANSACTION: 0x53fe7ef190c34d810c50fb66f0fc65a1ceedc10309cf4b4013d64042a0331156 Block: 239140867574 Date: Nov-30-2025 09:11:59 PM UTC ATTACK PATH: STEP 1: MINT FAKE TOKENS - Minted 235 trillion yETH tokens without collateral - Vulnerability: Legacy yETH contract lacked collateral validation - Cost: Gas fees only STEP 2: FLASH LOANS - Aave V3 Pool (0x87870bca3f3fd6335c3f4ce8392d69350b4fa4e2) * Borrowed: 200 cbETH (0xBe9895146f7AF43049ca1c1AE358B0541Ea49704) * Premium: 0.1 cbETH - Balancer Vault (0xba12222222228d8ba445958a75a0704d566bf2c8) * Borrowed: 4000 wstETH (0x7f39C581F595B53c5cb19bD0b3f8dA6c935E2Ca0) * Borrowed: 300 rETH (0xae78736Cd615f374D3085123A210448E74Fc6393) * Borrowed: 3100 WETH (0xC02aaA39b223FE8D0A0e5C4F27eAD9083C756Cc2) - Flash Loan Initiator: 0x12d0B1025B9ED926775e01F6A463f2702971C664 - Total borrowed: ~$20 million in assets STEP 3: DRAIN LIQUIDITY POOLS - Used fake yETH tokens + flash loaned assets - Targeted Balancer and Curve pools - Swapped fake yETH for real assets (ETH, stETH, cbETH, etc.) STEP 4: REPAY FLASH LOANS - Used stolen real assets to repay all flash loans - Retained profit after repayment STEP 5: CONVERT TO ETH - Uniswap V3 swaps: * 51.39 mETH -> 55.44 ETH ($155,590) * 230 cbETH -> 253.07 ETH ($708,015) * 202.17 ETHx -> 178.08 wstETH ($608,514) - Total extracted: 1,600 ETH (~$4.48M) STEP 6: MONEY LAUNDERING - Transferred 1,600 ETH through intermediate addresses - Laundered 800 ETH via Tornado Cash (8 x 100 ETH transfers) - Used self-destructing contracts: * 0xbb2789b418fa18f9526ba79fa7038d4e6d753f73 (Fake_Phishing1660361) * 0x3e8e7533dcf69c698cf806c3db22f7f10b9b0b97 (Phishing1660362) * 0xadbe952ebb9b3e247261d2e3b96835f00f721f8e (Phishing1660360) RESULT: - Total loss: ~$9 million - Tokens minted: 235 trillion yETH (uncollateralized) - ETH laundered: 800 ETH through Tornado Cash - Affected: Legacy yETH contract, Balancer pools, Curve pools - Not affected: Yearn V2 and V3 Vaults (confirmed secure) VULNERABILITY: Legacy yETH contract allowed unlimited token minting without proper collateral checks. The contract trusted users to only mint backed tokens, but no code enforced this requirement. ================================================ Solea Audit Group - Professional Smart Contract Security Audits Preventing exploits through comprehensive code analysis and security reviews.

solea.academy/#timeline This is a timeline of recent or ongoing smart contract audit competitions. Can you provide some advice on this timeline?

📌 The Mango Markets Exploit Date: October 11, 2022 Loss: Approximately $100 million Details: Mango Markets, a decentralized finance (DeFi) platform, was exploited through a combination of price manipulation and a vulnerability in its smart contract. The attacker manipulated the price of the platform's assets to borrow more than they were entitled to, resulting in a significant loss of funds. This incident highlighted the vulnerabilities in DeFi protocols and the potential risks associated with price oracles and liquidity pools. Impact: The hack not only led to substantial financial losses but also raised concerns about the security of DeFi platforms, emphasizing the critical need for thorough smart contract audits and improved risk management strategies. 💡 A comprehensive audit could have prevented this.

Peter said "Bitcoin has no future" He doesn't seem to be able to pinpoint the exact cause of the Bitcoin price decline. Or maybe he's looking further ahead? One reason for the price decline is his failure to properly audit the smart contract protocol.

📌 The Nomad Token Bridge Hack Date: August 1, 2022 Loss: Approximately $190 million Details: The Nomad Token Bridge, designed to facilitate token transfers across different blockchains, suffered a significant exploit when attackers took advantage of a vulnerability in its smart contract. By manipulating the contract's logic, they were able to withdraw a large amount of funds almost instantly. This incident underscored the vulnerabilities present in bridging protocols and the critical need for robust security measures in smart contracts. Impact: The hack not only led to substantial financial losses but also intensified scrutiny on the security of token bridges, emphasizing the necessity for thorough smart contract audits to safeguard user assets. 💡 A comprehensive audit could have prevented this.

📌 The Horizon Bridge Exploit Date: June 24, 2022 Loss: Approximately $100 million Details: The Horizon Bridge, used for transferring assets between the Harmony blockchain and other networks, was exploited when attackers compromised the bridge's smart contracts. They were able to withdraw a significant amount of cryptocurrency by exploiting vulnerabilities in the bridge's security protocols. This incident highlighted the risks associated with cross-chain bridges and the importance of implementing rigorous security measures. Impact: The exploit not only resulted in a major financial loss but also raised concerns about the security of cross-chain technologies and the urgent need for comprehensive smart contract audits. 💡 A comprehensive audit could have prevented this.

Smart contract audits are essential. 📌 The Ronin Network Hack Date: March 23, 2022 Loss: Approximately $620 million Details: Attackers exploited a security vulnerability in the Ronin Network, which is used for the popular game Axie Infinity. They gained access to private keys, allowing them to withdraw a significant amount of funds from the network's bridge. This incident highlighted the vulnerabilities in cross-chain bridges and the critical need for security in gaming and DeFi applications. Impact: The hack not only resulted in a massive financial loss but also raised concerns about the security of blockchain networks and the importance of rigorous smart contract audits. 💡 A comprehensive audit could have prevented this. #SmartContracts #SecurityAudit #Web3Security #Solea

Smart contract audits are essential. 📌 The Cream Finance Exploit Date: October 27, 2021 Loss: Approximately $130 million Details: Attackers exploited a vulnerability in the Cream Finance protocol, specifically targeting its lending and borrowing mechanisms. The exploit involved manipulating the way collateral was handled, allowing the attackers to drain funds from the protocol. Impact: This incident underscored the importance of thorough smart contract audits and the need for robust security measures in decentralized finance (DeFi) applications. 💡 A comprehensive audit could have prevented this. #SmartContracts #SecurityAudit #Web3Security #Solea

Smart contract audits are essential. 📌 The Poly Network Hack (2021) In August 2021, the Poly Network suffered a massive hack, resulting in the theft of over $600 million in various cryptocurrencies. The attackers exploited vulnerabilities in the network's smart contracts, highlighting the critical need for thorough security audits. Fortunately, most of the stolen funds were later returned, but the incident underscored the risks associated with poorly audited smart contracts. 💡 A comprehensive audit could have prevented this. #SmartContracts #SecurityAudit #Web3Security #Solea