Incident Archive

Arbitrary Call

The contract executes an external call with attacker-controlled target or calldata, letting them impersonate the contract. This archive tracks 21 incidents across 2022–2024, with $12.54M in cumulative losses.

Arbitrary Call

Jun 20, 2023

$17K drained from MIMSpell in an arbitrary call (June 2023)

$17K

Read post-mortem →

Arbitrary Call

Feb 18, 2023

Inside the RevertFinance Arbitrary Call — $30K gone on February 18, 2023

$30K

Read post-mortem →

Arbitrary Call

Feb 17, 2023

$1.5M drained from Dexible in an arbitrary call (February 2023)

$1.5M

Read post-mortem →

Arbitrary Call

Feb 7, 2023

CowSwap Arbitrary Call postmortem (February 2023) — $120K drained

$120K

Read post-mortem →

Arbitrary Call

Dec 25, 2022

How Rubic lost $1.5M to an arbitrary call in December 2022

$1.5M

Read post-mortem →

Arbitrary Call

Nov 9, 2022

BrahTOPG’s November 2022 arbitrary call, explained: $89K in losses

$89K

Read post-mortem →

Arbitrary Call

Nov 8, 2022

Inside the MEV_0ad8 Arbitrary Call — $282K gone on November 8, 2022

$282K

Read post-mortem →

Arbitrary Call

Oct 24, 2022

Postmortem: MulticallWithoutCheck Arbitrary Call, October 2022

Read post-mortem →

Arbitrary Call

Oct 11, 2022

The Rabby Wallet SwapRouter October 11, 2022 arbitrary call incident, on-chain breakdown

Read post-mortem →

Arbitrary Call

Sep 28, 2022

September 2022: MEVBOT hit by an arbitrary call, losing $1.47M

$1.47M

Read post-mortem →