OpenZeppelin Reveals Top 10 Blockchain Hacking Techniques in 2022

The first and second place bugs involved layer 2 scaling system Optimism and vanity address generator Profanity.

AccessTimeIconMar 17, 2023 at 3:09 a.m. UTC
Updated Mar 17, 2023 at 3:06 p.m. UTC

OpenZeppelin, a crypto cybersecurity company that provides an open-source framework to develop secure smart contracts, on Thursday U.S. time revealed the final results of the top 10 blockchain hacking techniques of 2022, in an effort to make the crypto space more safe.

First and second place included a bug on the software node level of layer 2 scaling system Optimism and a vulnerability on the key generation level of vanity address generator Profanity. The Optimism bug, if exploited, causes “an infinite mint” of Optimism’s native token OP that “would collapse many (if not all) Optimism protocols,” while the vulnerability on Profanity put at least $160 million at risk, said Ashiq Amien, one of the six panelists on the project.

All of the hacking techniques were already publicly disclosed in 2022, before the start of the project.

Following Monday’s $200 million exploit of decentralized finance (DeFi) lending protocol Euler Finance, the reveal of top 10 hacking techniques is meant to highlight the best practices for security measures on various levels of blockchain code including the smart contract level, key generation level and node level.

The project “helps to push security boundaries forward and strengthen the security of the whole ecosystem by basically accumulating all the research and ideally surfacing underrated research,” said Nikita Stupin, a blockchain security engineer and researcher at OpenZeppelin.

Stupin added in an interview with CoinDesk, “This primarily is for security researchers so that they are up to date with the most novel approaches, the most novel techniques, or the most novel attack vectors so that they can apply them and see them in their audits.”

Additional members of top 10 list include a bug that allowed exploiters to empty all wrapped token contracts, potentially forcing the wrapped ether (wETH) contract to be insolvent and a vulnerability on the Avalanche blockchain that was used to break security assumptions of several protocols, including decentralized exchange SushiSwap and lending platform Abracadabra, according to the announcement.

Community members first picked on the top 15 hacking techniques that occurred in 2022, while a panel of six blockchain security experts, which included Paradigm’s head of security Samczsun, determined the top 10 from the community list.


Please note that our privacy policy, terms of use, cookies, and do not sell my personal information has been updated.

CoinDesk is an award-winning media outlet that covers the cryptocurrency industry. Its journalists abide by a strict set of editorial policies. In November 2023, CoinDesk was acquired by the Bullish group, owner of Bullish, a regulated, digital assets exchange. The Bullish group is majority-owned by; both companies have interests in a variety of blockchain and digital asset businesses and significant holdings of digital assets, including bitcoin. CoinDesk operates as an independent subsidiary with an editorial committee to protect journalistic independence. CoinDesk employees, including journalists, may receive options in the Bullish group as part of their compensation.

Sage D. Young

Sage D. Young was a tech protocol reporter at CoinDesk. He owns a few NFTs, gold and silver, as well as BTC, ETH, LINK, AAVE, ARB, PEOPLE, DOGE, OS, and HTR.