# 2025-2026 के सबसे बड़े Smart Contract Hacks — सीखे गए सबक

Security tooling में advances के बावजूद, 2025-2026 में DeFi hacks में $823 million चोरी हुए। कुछ exploits novel थे, कुछ शर्मनाक रूप से simple थे। यहां सबसे बड़े incidents का breakdown है और वो critical lessons जो हर developer को internalize करने चाहिए।

Hacks

1. ChainBridge Exploit — $187M (May 2025)

क्या हुआ:

ChainBridge, एक cross-chain bridge, को अपने withdrawal logic पर reentrancy attack मिला। Attacker ने 4 chains पर liquidity pools drain कर दिए।

Technical details:

// Vulnerable code (simplified)
function withdraw(uint256 amount, address token) external {
    require(balances[msg.sender][token] >= amount, "Insufficient balance");

    // VULNERABLE: External call before state update
    IERC20(token).transfer(msg.sender, amount);

    // State update AFTER external call
    balances[msg.sender][token] -= amount;
}

Attacker ने एक malicious ERC20 token बनाया जिसके transfer function ने withdraw को फिर से call किया, balance update होने से पहले contract को drain कर दिया।

Fix:

function withdraw(uint256 amount, address token) external {
    require(balances[msg.sender][token] >= amount, "Insufficient balance");

    // Update state BEFORE external call (Checks-Effects-Interactions)
    balances[msg.sender][token] -= amount;

    // External call last
    IERC20(token).transfer(msg.sender, amount);
}

Lesson learned:

हमेशा Checks-Effects-Interactions pattern follow करें। External calls बनाने से पहले state update करें। यह DeFi 101 है, फिर भी bridges इसे गलत करते हैं।

बेहतर है, OpenZeppelin का ReentrancyGuard use करें:

import "@openzeppelin/contracts/security/ReentrancyGuard.sol";

contract SecureBridge is ReentrancyGuard {
    function withdraw(uint256 amount, address token) external nonReentrant {
        // Safe even with external calls
    }
}

2. OmniLend Flash Loan Attack — $142M (August 2025)

क्या हुआ:

OmniLend, एक lending protocol, ने एक manipulable price oracle use किया। Attacker ने flash loan use करके price manipulate किया, max collateral borrow किया, और कभी repay नहीं किया।

Attack flow:

Aave से 100,000 ETH flash loan

Uniswap पर OMNI token के लिए 50,000 ETH swap (OMNI price pump होती है)

OmniLend में 50,000 ETH को collateral के रूप में deposit करें

Inflated OMNI price के based पर max USDC borrow करें

OMNI को वापस ETH में swap करें (price crash होती है)

Aave flash loan repay करें

Profit: $142M USDC में

Vulnerable oracle:

// VULNERABLE: Single DEX as price source
function getPrice() external view returns (uint256) {
    (uint112 reserve0, uint112 reserve1,) = uniswapPair.getReserves();
    return (reserve1 * 1e18) / reserve0; // Trivially manipulable
}

Fix:

Time-weighted average price (TWAP) या multiple oracle sources use करें:

import "@chainlink/contracts/src/v0.8/interfaces/AggregatorV3Interface.sol";

contract SecureOracle {
    AggregatorV3Interface internal priceFeed;

    constructor(address _priceFeed) {
        priceFeed = AggregatorV3Interface(_priceFeed);
    }

    function getPrice() external view returns (uint256) {
        (, int256 price,,,) = priceFeed.latestRoundData();
        require(price > 0, "Invalid price");
        return uint256(price);
    }
}

Lesson learned:

कभी भी single DEX से spot prices use न करें। Chainlink, Pyth, या TWAP oracles use करें। अगर आपको DEX prices use करने हैं, तो multiple sources combine करें और sanity checks add करें।

3. FlexDAO Governance Takeover — $95M (November 2025)

क्या हुआ:

FlexDAO के governance contract में एक flaw था: voting power snapshot proposal creation के AFTER लिया जाता था, जब votes cast किए जाते थे तब नहीं। Attacker ने:

Treasury drain करने के लिए proposal create किया

Governance tokens flash loan किए

Flash-loaned tokens के साथ vote किया

Tokens return किए (same transaction में)

Proposal "majority" vote के साथ pass हुआ

2 दिन बाद proposal execute किया

Vulnerable governance logic:

// VULNERABLE: Snapshot taken at proposal creation
function propose(address target, bytes calldata data) external returns (uint256) {
    uint256 proposalId = proposalCount++;
    proposals[proposalId] = Proposal({
        target: target,
        data: data,
        votesFor: 0,
        votesAgainst: 0,
        snapshot: block.number // Snapshot is NOW
    });
    return proposalId;
}

function vote(uint256 proposalId, bool support) external {
    uint256 votes = token.balanceOf(msg.sender); // No snapshot check!
    if (support) {
        proposals[proposalId].votesFor += votes;
    } else {
        proposals[proposalId].votesAgainst += votes;
    }
}

Fix:

function vote(uint256 proposalId, bool support) external {
    Proposal storage proposal = proposals[proposalId];

    // Use balance at snapshot block
    uint256 votes = token.balanceOfAt(msg.sender, proposal.snapshot);
    require(votes > 0, "No voting power at snapshot");

    // Rest of voting logic...
}

Lesson learned:

Governance complex है। OpenZeppelin Governor जैसे battle-tested frameworks use करें। अपना खुद का governance roll न करें जब तक आप extensive audits के लिए prepared न हों।

4. SynthSwap Price Manipulation — $78M (January 2026)

क्या हुआ:

SynthSwap, एक synthetic asset DEX, ने हर trade के बाद reserves use करके prices calculate किए। Attacker ने slippage से profit करने के लिए large trades sandwich किए।

Attack:

Large buy order frontrun करें (victim से पहले buy करें)

Victim का trade execute होता है (price को up push करता है)

Backrun (inflated price पर sell करें)

Victim की slippage से profit करें

Vulnerable AMM logic:

function swap(uint256 amountIn, address tokenIn, address tokenOut) external {
    // Calculate output based on current reserves (vulnerable to sandwich)
    uint256 amountOut = getAmountOut(amountIn, reserveIn, reserveOut);

    // Execute swap
    IERC20(tokenIn).transferFrom(msg.sender, address(this), amountIn);
    IERC20(tokenOut).transfer(msg.sender, amountOut);

    // Update reserves
    reserveIn += amountIn;
    reserveOut -= amountOut;
}

Fix:

Slippage protection implement करें:

function swap(
    uint256 amountIn,
    uint256 minAmountOut, // User-specified minimum
    address tokenIn,
    address tokenOut
) external {
    uint256 amountOut = getAmountOut(amountIn, reserveIn, reserveOut);
    require(amountOut >= minAmountOut, "Slippage too high");

    // Rest of swap logic...
}

Lesson learned:

सभी DEX trades में slippage protection होना चाहिए। Users को minAmountOut specify करना चाहिए। Frontends को इसे automatically calculate करना चाहिए (e.g., 0.5% slippage tolerance)।

5. MultiChain Bridge Validator Compromise — $64M (March 2026)

क्या हुआ:

MultiChain के bridge ने validation के लिए 3-of-5 multisig use किया। Attackers ने phishing के through 3 validator keys compromise किए और bridge drain कर दिया।

Smart contract bug नहीं — यह operational security failure था।

Lesson learned:

Validator keys के लिए hardware wallets use करें

Timelock delays implement करें (e.g., large withdrawals के लिए 24h delay)

Unusual activity के लिए monitor करें

Key rotation के साथ threshold signatures use करें

// Timelock for large withdrawals
uint256 constant LARGE_WITHDRAWAL = 100_000e18; // $100k
uint256 constant TIMELOCK_DELAY = 24 hours;

function requestWithdrawal(uint256 amount) external {
    if (amount > LARGE_WITHDRAWAL) {
        pendingWithdrawals[msg.sender] = Withdrawal({
            amount: amount,
            timestamp: block.timestamp
        });
    } else {
        _executeWithdrawal(msg.sender, amount);
    }
}

function executeWithdrawal() external {
    Withdrawal memory w = pendingWithdrawals[msg.sender];
    require(block.timestamp >= w.timestamp + TIMELOCK_DELAY, "Timelock active");
    _executeWithdrawal(msg.sender, w.amount);
}

Hacks में Common Patterns

1. Reentrancy (ChainBridge)

Root cause: State updates से पहले external calls

Prevention:

ReentrancyGuard use करें

Checks-Effects-Interactions follow करें

Reentrancy flags के लिए transient storage use करने पर consider करें (Solidity 0.8.28+)

2. Oracle Manipulation (OmniLend, SynthSwap)

Root cause: Manipulable price sources पर reliance

Prevention:

Chainlink या other decentralized oracles use करें

DEX prices के लिए TWAP implement करें

Sanity checks (max price deviation per block)

3. Access Control (FlexDAO)

Root cause: Governance/voting पर flash loan attacks

Prevention:

Proposal creation से BEFORE voting power snapshot करें

OpenZeppelin Governor use करें

Proposal delays add करें (passing के तुरंत बाद execute नहीं कर सकते)

4. Operational Security (MultiChain)

Root cause: Compromised validator keys

Prevention:

Hardware wallets + cold storage

Large operations के लिए timelocks

Monitoring + alerting

Regular key rotation

Security Checklist

Mainnet पर deploy करने से पहले, verify करें:

[ ] सभी external calls पर Reentrancy protection

[ ] Oracle sources manipulation-resistant हैं

[ ] Access control principle of least privilege follow करता है

[ ] Critical operations के लिए Timelocks

[ ] सभी trades के लिए Slippage protection

[ ] Governance snapshot voting use करता है

[ ] Emergency situations के लिए Pausability

[ ] Upgrade mechanism secure है (अगर proxies use कर रहे हैं)

[ ] Reputable firm द्वारा Audited (Trail of Bits, OpenZeppelin, etc.)

[ ] Mainnet से पहले Bug bounty program live है

[ ] Critical logic के लिए Formal verification (अगर budget allow करता है)

Secure Development के लिए Resources

Tools:

Slither — Static analysis

Mythril — Symbolic execution

Echidna — Fuzzing

Foundry — Built-in fuzzing के साथ testing framework

Learning:

Solingo Security Course — Basics से advanced exploits तक

Ethernaut — Interactive security challenges

Damn Vulnerable DeFi — Hacking challenges

Secureum Bootcamp — Security engineer training

Audit Firms:

Trail of Bits

OpenZeppelin

Consensys Diligence

Spearbit

Code4rena (competitive audits)

Conclusion

$823 million चोरी हुए। हज़ारों users affected हुए। अधिकांश vulnerabilities preventable थीं।

DeFi security landscape unforgiving है। एक गलती minutes में एक protocol drain कर सकती है। लेकिन patterns known हैं:

Checks-Effects-Interactions follow करें

Battle-tested oracles use करें

Flash loan attacks से protect करें

Timelocks और monitoring implement करें

$800M+ lost करके यह सबक expensive तरीके से सीखा गया। अपने contracts में इन mistakes repeat न करें।

2025-2026 के सबसे बड़े Smart Contract Hacks — सीखे गए सबक

Hacks

1. ChainBridge Exploit — $187M (May 2025)

2. OmniLend Flash Loan Attack — $142M (August 2025)

3. FlexDAO Governance Takeover — $95M (November 2025)

4. SynthSwap Price Manipulation — $78M (January 2026)

5. MultiChain Bridge Validator Compromise — $64M (March 2026)

Hacks में Common Patterns

1. Reentrancy (ChainBridge)

2. Oracle Manipulation (OmniLend, SynthSwap)

3. Access Control (FlexDAO)

4. Operational Security (MultiChain)

Security Checklist

Secure Development के लिए Resources

Conclusion

संबंधित लेख

Solidity 2026 में: जानने योग्य नई Features

Foundry vs Hardhat 2026 — कौन सा Framework चुनें?

सबसे Common Solidity Vulnerabilities

Practice में लगाने के लिए तैयार हैं?