Feb, 2025

[H-01] Cross-chain signature replay attack due to user-supplied domainSeparator and missing deadline check

Next Generation : EVM

[H-01] Change other users' boost values at will, updateUserBoost()
[H-02] Freeze rewards due to gauge manipulation
[H-03] Improper debt management in lendingpool due to incorrect variable usage
[L-01] Emergency Unlock Logic Incomplete
[L-02] user who has a ALLOCATOR_ROLE role can overwrite funds without adding it

RAAC (Regnum Aurum Acquisition Corp) : EVM

[H-01] Reward is always set to 0, no reward can be received
[H-02] Due to fees not being collected, the service suffers financial losses

DatingDApp (First Flights) : EVM

---

Mar, 2025

[L-01] Due to incorrect settings of holding period, campaign participants may never receive rewards (Downgrade)

Nudge.xyz : EVM

---

Apr, 2025

[M-01] Cancelled withdrawals are not removed from the L1 delegation queue, potentially resulting in ghost delegation or redundant L1 operations

Kinetiq, LST on Hyperliquid : EVM

[L-01] Reward Distribution Precision Loss Due to Integer Truncation

Starknet Staking : CVM/Private

---

May, 2025

[L-01] Incorrect configuration breaks the core protocol assumptions (Downgrade)

Upside : EVM

[M-01] L2Governor.execute() accepts Expired / Defeated proposals, attacker front-runs BlackGovernor nudge(), blocks legitimate emission-rate votes, freezes tail emissions

Blackhole : EVM