Same-root-cause repeat exploit

Methodology how we score #

**What this measures** This factor flags whether a protocol has been exploited two or more times via the same root-cause cluster. Root-cause clusters are defined in the hacks database synthesis (e.g., oracle manipulation, flash-loan governance, CEI reentrancy, off-chain key compromise). A positive flag indicates the first exploit did not produce a fix that prevented recurrence -- either the fix was incomplete, the pattern existed in an unpatched sister contract, or the team failed to apply the lesson across all affected surfaces.

**Why it matters** Same-root-cause repeat exploits are the clearest signal of incomplete remediation. Deus DAO 2 is the most precise example: the attacker in the second incident specifically bypassed the oracle fix deployed after the first incident by exploiting a zero-day in Solidly's flash-swap mechanism that the new oracle did not filter, and that bypass happened in just forty days. Compound reentrancy was exploited four times across different fork instances of the same codebase. Same-root-cause recurrence indicates the team either does not understand the original vulnerability well enough to remediate fully, or lacks the audit discipline to verify the fix holds across all affected surfaces.

**Green / Yellow / Red** Green: no same-root-cause repeat exploit in the hacks database. Yellow: one prior exploit with a root cause documented and patched, but patch applied to only some affected contracts, with others still unverified. Red: confirmed same-root-cause second exploit, regardless of time elapsed between incidents.

**Common gray cases** When two incidents share a root-cause cluster but the second uses a novel sub-technique (e.g., bypassing a specific fix via a different entry point), it is still classified as same-root-cause because the underlying architectural weakness is identical. Curator judgment is required to distinguish genuine different-vector from disguised same-vector recurrence.

**Notable historical examples** - **Compound Finance** ($147M, 2021): Reentrancy cluster exploited across multiple forks; each instance is same-root-cause propagation. - **Deus DAO** ($6.5M, 2023): Second attacker bypassed the specific oracle fix from the first incident in forty days. - **Onyx Protocol** ($2.1M, 2023): Same empty-market vector exploited twice on the same protocol. - **Platypus Finance** ($8.5M, 2023): Three incidents in eight months with overlapping collateral accounting root cause. - **AlexLab** ($16.18M, 2025): First was key compromise, second was vault permission -- confirmed different root-cause clusters, not same-root-cause.

Measurement what to look for #

Determine whether the protocol has been exploited ≥2 times via the same root-cause cluster.

Data & output #

Scored protocols 80 carry this factor #

Linked hacks 13 historical incidents #