GM anon!
Welcome to this month’s QuillAudits roundup, where we discuss everything we’ve been doing in Web3 security.
Month In Review
This month, attacks on various protocols resulted in a loss of over $127.7 million. Reasons for the attack varied from Access Control, Improper Input Validation, and Donation Attack. The largest hack witnessed was on Nobitex due to a problem with Access Control, which led to the loss of $100m. All of these funds were directed to burner addresses, which are unretrievable. The other major attacks include Resupply ($9.8m), Alex Labs ($8.37m), and Force Bridge ($3.76m).
Auditing Stats from June
Featured Research & Blogs
Read about Major Hacks from Last Month
Meta Pool: Meta pool, a LST provider on multiple blockchains, got hit with an exploit that led to the minting of $27m worth of mpETH tokens, but the only loss taken was $130k due to the low liquidity of the pool. The protocol's mint function lacked access control and didn’t verify the deposit first. Though the protocol was able to retrieve $117k worth of assets as the attack was frontrun by a whitehat, Yoink.
Resupply Hack: Resupply, a CDP protocol, got hit with a donation attack which led to the loss of $9.8m. The attack failed the solvency check for the attacker, marking the address solvent, and gave a loan of 10m reUSD with almost no upfront collateral.
Silo Finance: Silo Finance, a lending and borrowing protocol, got hit by an attack that led to the loss of $550k. The flaw was in the new feature testing contracts, which didn’t verify the calldata provided by the attacker and what had to be a swap transaction converted to a borrow transaction, taking collateral from the victim.
Read detailed blogs on different verticals across the ecosystem
Guide to HyperEVM and its Ecosystem: Learn about how HyperEVM and HyperCore work in parallel to provide a great experience to users and the growing HyperEVM ecosystem.
Guide to Oracle Manipulation Attacks: Learn about how oracle manipulation attacks occur and their remediation.
Partnerships & Collaborations
We have partnered with Haven1 to secure DApps building on top of its core modules. This would ensure security is embedded directly into their ecosystem.
Partnered with Yardhub for their Web3 Growth Camp 4, adding to our earlier partnerships from Camp 2.
|
QuillAudits | Web3 Security 🥷
@QuillAudits_AI
|
5:9 PM • Jun 24, 2025
|
|
Collaborated with BNB Chain for their Kickstarter program to provide audit services to all the projects involved with perks, including a 20% discount on auditing services, on-chain monitoring, post-audit marketing boost, and more.
|
QuillAudits | Web3 Security 🥷
@QuillAudits_AI
|
6:47 PM • Jun 13, 2025
|
|
Joined the Soneium marketplace on Areta as a whitelisted auditor. Builders can request quotes from multiple audit providers, including us, to get the best prices according to their budget and faster services.
|
QuillAudits | Web3 Security 🥷
@QuillAudits_AI
|
8:13 PM • Jun 12, 2025
|
|
Partnered with CV Labs to provide benefits like audit grants to builders in their past and present accelerator.
|
QuillAudits | Web3 Security 🥷
@QuillAudits_AI
|
1:35 PM • Jun 10, 2025
|
|
Joined the Uniswap marketplace on Areta as a whitelisted auditor. Builders can request quotes from multiple audit providers, including us, to get the best prices according to their budget and faster services.
|
QuillAudits | Web3 Security 🥷
@QuillAudits_AI
|
1:59 PM • Jun 5, 2025
|
|
Partnered with Cointelegraph Accelerator for the pitch day in ETHCC. It is a curated networking event where teams can pitch their product and get validated faster. Moreover, winning teams get audit grants up to $50k from us.
|
QuillAudits | Web3 Security 🥷
@QuillAudits_AI
|
7:34 PM • Jul 1, 2025
|
|
Wanna partner up w/ us or want to get your project audited? |
|
|
Have a great day,
Team QuillAudits
