Hack history / 2026 / Hack or exploit
SetProtocol
Hack or exploit on Oct 6, 2026 · actualizeFee() is permissionless and recomputes unitShares with a divCeil even when it mints zero fee, rounding the backing collateral per share up by one with no fee actually taken, so issuing the rebalancing set before the bump and redeeming the same quantity after returns more collateral than was
ONE SOURCE · 1 SOURCE
Lost
$14K
dollars at the time
Returned
none listed
as the sources state it
Rank
#2,208
among thefts by dollars lost
What happened
No description from DefiLlama or SlowMist; see the sources below.
Details
- Date
- Oct 6, 2026
- Kind
- Hack or exploit
- Method
- actualizeFee() is permissionless and recomputes unitShares with a divCeil even when it mints zero fee, rounding the backing collateral per share up by one with no fee actually taken, so issuing the rebalancing set before the bump and redeeming the same quantity after returns more collateral than was
- How in
- Smart contract bug
- Target
- not stated
- Chains
- not stated
Reported by
- DeFiHackLabs exploit reproduction only
Cite this page
SwanBluechip, "SetProtocol hack, Oct 6, 2026: $14K lost", Crypto hack history, https://swan-hack-tracker.pages.dev/history/i/ht61561fd0ad/ (data as of 2026-10-31).