DeFi Security · Vulnerability class
Business logic flaws
The code does what it was written to do, but the design allows a sequence of legitimate actions that breaks an assumption.
The concept
Not every exploit is a classic bug. Some are state transitions nobody modelled, such as crediting a balance before an asynchronous step can fail.
Defensive lessons
- Model failure paths, not only success paths.
- Fuzz invariants, not only functions.
- Review legacy code on a schedule.
Stored incidents
2026-09-29 · reported loss $3.8M
NEAR Intents: ghost funds from a deposit notification bugOfficial statement