{"investigation":{"slug":"dexodus-finance","entity_name":"Dexodus Finance","trust_score":48,"severity_base":null,"score_modifier":13,"confidence":0.62,"status":"draft","content_type":"investigation","summary":"Dexodus Finance is a perpetual decentralized exchange (DEX) built on the Base network, founded in 2023 and based in Barcelona, Spain. The protocol offers oracle-based perpetual trading with copy trading, gasless trading, and gamified features. On May 26, 2025, the protocol suffered a smart contract exploit resulting in approximately $291,000–$300,000 in losses from its liquidity pool due to a stale Chainlink oracle signature replay vulnerability; the team reported full fund recovery within 24 hours and subsequently launched a revised V2 protocol audited by Halborn.","sections":[{"content":"Dexodus Finance is an oracle-based perpetual DEX operating on the Base network (an Ethereum Layer 2 chain). According to its official documentation, the protocol offers perpetual trading on crypto indices, real-world asset (RWA) markets, copy trading, gasless trading, and 1-click trading, with gamification elements including trading battles, leagues, fee rakebacks, and jackpots. The platform uses Chainlink Data Streams for price feeds. Dexodus Finance was founded in 2023 and is incorporated in Barcelona, Spain, according to Tracxn company profile data. The known co-founders are Miguel Jalon (CEO), Omar Alshaeb Foz (COO), and Alvaro Luque Vargas (CTO). TVL on DeFiLlama was approximately $266,000 as of late May 2025, reflecting the protocol's early-stage scale.","heading":"Protocol Overview","sources":[{"url":"https://docs.dexodus.finance/","name":"Dexodus Finance — Official Documentation Overview","type":"official","credibility":2},{"url":"https://tracxn.com/d/companies/dexodus/__zdky1RGiu4H__hbUCIbACv0IrffrxdueStGtghorcU0","name":"Dexodus — Tracxn Company Profile","type":"other","credibility":2},{"url":"https://defillama.com/protocol/dexodus-finance","name":"Dexodus Finance TVL Stats — DeFiLlama","type":"research","credibility":2},{"url":"https://rocketreach.co/dexodus-finance-management_b6973982c97b67de","name":"Dexodus Finance Management Team — RocketReach","type":"other","credibility":3}],"severity":"low"},{"content":"On May 26, 2025, Dexodus Finance suffered a smart contract exploit on the Base network that resulted in losses of approximately $291,000–$300,000 from its liquidity pool. This was a security incident in which the protocol was a victim of an external attacker; it does not represent internal misconduct or fraud by the team.\n\nThe root cause was a missing timestamp validation check in the protocol's performUpkeep() function, which accepts Chainlink oracle price reports. According to post-incident analyses by QuillAudits and SolidityScan, the function did not verify the freshness of submitted price data, allowing an attacker to replay a valid but month-old Chainlink oracle signature showing ETH priced at approximately $1,816 — well below the market price of roughly $2,520 at the time.\n\nThe attacker's methodology, per the QuillAudits and SolidityScan analyses: (1) borrowed $10,500 via a flash loan from Balancer; (2) submitted the stale oracle report to the protocol, setting the apparent ETH price to ~$1,816; (3) opened a 100x leveraged long position with $10,000 collateral, creating a ~$1 million notional position at the artificially low price; (4) immediately restored the price feed to the market rate and closed the position, capturing the price difference; and (5) repaid the flash loan and retained approximately $291,000–$300,000 in profit from the liquidity pool.\n\nThe exploit was classified by SolidityScan as OWASP SC02:2025 Price Oracle Manipulation. The attack transaction hash on Base is 0x6ffb494293fc5c32c5a6ab7dc3fff1fcc6e90fba9a6d6e486ba0a15ce518147e.\n\nNote: This incident is attributable to a smart contract vulnerability exploited by an unknown external actor, not to any conduct by the Dexodus Finance team.","heading":"May 2025 Smart Contract Exploit","sources":[{"url":"https://www.quillaudits.com/blog/hack-analysis/dexodus-finance-exploit","name":"Dexodus Finance Exploit Analysis — QuillAudits","type":"research","credibility":2},{"url":"https://quillaudits.medium.com/dexodus-lost-300k-in-a-signature-replay-attack-heres-the-breakdown-46b7165970e2","name":"Dexodus Lost $300K in a Signature Replay Attack — QuillAudits Medium","type":"research","credibility":2},{"url":"https://blog.solidityscan.com/dexodus-finance-hack-analysis-d699135f575c","name":"Dexodus Finance Hack Analysis — SolidityScan Blog","type":"research","credibility":2},{"url":"https://coinsbench.com/dexodus-finance-exploit-how-a-stale-chainlink-report-enabled-a-291k-price-manipulation-attack-39dcee1efff0","name":"Dexodus Finance Exploit: Stale Chainlink Report Enabled ~$291K Attack — CoinsBench","type":"news_article","credibility":2}],"severity":"high"},{"content":"Following the May 26, 2025 exploit, the Dexodus Finance team stated publicly that it achieved full recovery of all affected liquidity pool funds within 24 hours of the attack. According to the QuillAudits analysis, approximately 107 ETH was transferred to a team-controlled multisig wallet — described as a white-hat recovery mechanism — while the attacker moved remaining funds via Stargate bridge to Ethereum and then to Binance.\n\nThe team deprecated Perps V1 and launched Perps V2 following the exploit. They stated that all affected users would be refunded. Security partners cited in public communications included Halborn, SEAL 911, Chainlink Security, and Binance for wallet tracing.\n\nThe team also engaged Halborn for a formal audit of DexodusV2, listed in Halborn's audit registry. A separate Halborn audit of the WeightedLiquidityPool component was dated November 20, 2024, predating the exploit. Coinpedia published an article characterizing Dexodus's response as exemplary for DeFi incident recovery.\n\nThe stated fund recovery claim has not been independently confirmed by on-chain analytics providers in verifiable Tier 1 or Tier 2 sources reviewed for this investigation. Users should verify the recovery status independently.","heading":"Incident Response and Recovery","sources":[{"url":"https://www.quillaudits.com/blog/hack-analysis/dexodus-finance-exploit","name":"Dexodus Finance Exploit Analysis — QuillAudits","type":"research","credibility":2},{"url":"https://www.halborn.com/audits/dexodus/dexodusv2","name":"DexodusV2 Audit — Halborn Audit Reports","type":"other","credibility":2},{"url":"https://coinpedia.org/information/dexodus-demonstrates-what-defi-recovery-should-look-like/","name":"Dexodus Demonstrates What DeFi Recovery Should Look Like — Coinpedia","type":"news_article","credibility":2},{"url":"https://x.com/DexodusFinance/status/1927323039361913077","name":"Dexodus Finance — Official X announcement of technical incident","type":"social_media","credibility":3}],"severity":"medium"},{"content":"Dexodus Finance's smart contracts have been reviewed by Halborn, a recognized blockchain security firm. Halborn's public audit registry lists at least two engagements: a WeightedLiquidityPool audit dated November 20, 2024, and a DexodusV2 audit. The V1 exploit occurred despite the earlier Halborn engagement, indicating the specific oracle timestamp validation flaw was not caught in the pre-exploit audit scope or was introduced after the audit. The post-exploit V2 engagement was reported as dated August 1, 2025. Olympix, a smart contract monitoring firm, published a substack post noting that certain vulnerabilities in the class of the Dexodus exploit could have been flagged earlier with automated tooling.","heading":"Security Audits","sources":[{"url":"https://www.halborn.com/audits/dexodus","name":"Halborn Audit Reports — Dexodus","type":"other","credibility":2},{"url":"https://www.halborn.com/audits/dexodus/dexodusv2","name":"DexodusV2 Audit — Halborn","type":"other","credibility":2},{"url":"https://olympix.substack.com/p/419k-could-have-been-saved-if-only","name":"419k Could Have Been Saved — Olympix Substack","type":"research","credibility":2},{"url":"https://docs.dexodus.finance/security-audits","name":"Security Audits — Dexodus Finance Docs","type":"official","credibility":2}],"severity":"medium"},{"content":"Dexodus Finance has a native token referred to as DXF (or DXD in some early references), awarded via a points system called DXPoints that users earn through platform activity. A token listed as DXF with the contract address 9eEcioewNN6hcvRsYAT5UPko4R4gfLgz9XQhGRPqpump appears on Pump.fun on Solana with a reported market cap of approximately $4,919, which is a negligible capitalization and may represent an unofficial or community-created token rather than the primary protocol token. Users should verify token contract addresses via the official Dexodus documentation before interacting with any DXF-labeled token. The primary protocol operates on Base (Ethereum L2), not Solana, so the Pump.fun listing warrants caution as a potential impersonation or unofficial derivative.","heading":"Token and Ecosystem Notes","sources":[{"url":"https://docs.dexodus.finance/protocol/points","name":"Dexodus Finance Points — Official Docs","type":"official","credibility":2},{"url":"https://pump.fun/coin/9eEcioewNN6hcvRsYAT5UPko4R4gfLgz9XQhGRPqpump","name":"Dexodus Finance (DXF) — Pump.fun","type":"on_chain","credibility":3}],"severity":"medium"},{"content":"No regulatory actions, enforcement proceedings, or lawsuits involving Dexodus Finance have been identified in searches of SEC, CFTC, or DOJ records as of the date of this investigation. The project has no known OFAC sanctions designation. The absence of regulatory findings is not an endorsement; the protocol operates as a decentralized derivatives platform, a category that regulators in multiple jurisdictions continue to scrutinize.","heading":"Regulatory and Legal Standing","sources":[],"severity":"low"}],"timeline":[{"date":"2023","event":"Dexodus Finance founded in Barcelona, Spain (approximate year; exact date not publicly documented).","source":"Tracxn company profile","source_url":"https://tracxn.com/d/companies/dexodus/__zdky1RGiu4H__hbUCIbACv0IrffrxdueStGtghorcU0","date_original":"2023-01-01"},{"date":"2024-11-20","event":"Halborn completes WeightedLiquidityPool security audit for Dexodus.","source":"Halborn Audit Reports","source_url":"https://www.halborn.com/audits/dexodus"},{"date":"2025-01-13","event":"Dexodus Finance mainnet goes live (within 24 hours of January 13, 2025 countdown post).","source":"Dexodus Finance on X","source_url":"https://x.com/DexodusFinance/status/1879135896706138383"},{"date":"2025-02-05","event":"Dexodus Finance launches Phase 3 of its Private Mainnet, inviting 500 new traders.","source":"Blockchain.news Flash News","source_url":"https://blockchain.news/flashnews/dexodus-finance-launches-phase-3-of-private-mainnet-for-perpetual-trading"},{"date":"2025-05-26","event":"Dexodus Finance suffers a smart contract exploit on Base network via stale Chainlink oracle signature replay, resulting in approximately $291,000–$300,000 in liquidity pool losses. The team reports full fund recovery and deprecates Perps V1.","source":"QuillAudits Hack Analysis","source_url":"https://www.quillaudits.com/blog/hack-analysis/dexodus-finance-exploit"},{"date":"2025-08","event":"Halborn completes DexodusV2 audit (date per Halborn audit registry).","source":"Halborn Audit Reports — Dexodus","source_url":"https://www.halborn.com/audits/dexodus","date_original":"2025-08-01"}],"sources_used":[{"url":"https://docs.dexodus.finance/","name":"Dexodus Finance — Official Documentation","type":"official","archive_url":"http://web.archive.org/web/20260209183104/https://docs.dexodus.finance/","credibility":2,"archive_timestamp":"2026-02-09T18:31:04+00:00"},{"url":"https://www.quillaudits.com/blog/hack-analysis/dexodus-finance-exploit","name":"Dexodus Finance Exploit Analysis — QuillAudits","type":"research","archive_url":"http://web.archive.org/web/20260417051734/https://www.quillaudits.com/blog/hack-analysis/dexodus-finance-exploit","credibility":2,"archive_timestamp":"2026-04-17T05:17:34+00:00"},{"url":"https://quillaudits.medium.com/dexodus-lost-300k-in-a-signature-replay-attack-heres-the-breakdown-46b7165970e2","name":"Dexodus Lost $300K in a Signature Replay Attack — QuillAudits Medium","type":"research","archive_url":"http://web.archive.org/web/20251024150013/https://quillaudits.medium.com/dexodus-lost-300k-in-a-signature-replay-attack-heres-the-breakdown-46b7165970e2","credibility":2,"archive_timestamp":"2025-10-24T15:00:13+00:00"},{"url":"https://blog.solidityscan.com/dexodus-finance-hack-analysis-d699135f575c","name":"Dexodus Finance Hack Analysis — SolidityScan Blog","type":"research","archive_url":"http://web.archive.org/web/20260512180008/https://blog.solidityscan.com/dexodus-finance-hack-analysis-d699135f575c/","credibility":2,"archive_timestamp":"2026-05-12T18:00:08+00:00"},{"url":"https://coinsbench.com/dexodus-finance-exploit-how-a-stale-chainlink-report-enabled-a-291k-price-manipulation-attack-39dcee1efff0","name":"Dexodus Finance Exploit: Stale Chainlink Report — CoinsBench","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinpedia.org/information/dexodus-demonstrates-what-defi-recovery-should-look-like/","name":"Dexodus Demonstrates What DeFi Recovery Should Look Like — Coinpedia","type":"news_article","archive_url":"http://web.archive.org/web/20260125085446/https://coinpedia.org/information/dexodus-demonstrates-what-defi-recovery-should-look-like/","credibility":2,"archive_timestamp":"2026-01-25T08:54:46+00:00"},{"url":"https://www.halborn.com/audits/dexodus/dexodusv2","name":"DexodusV2 Audit — Halborn Audit Reports","type":"other","archive_url":"http://web.archive.org/web/20260513001102/https://www.halborn.com/audits/dexodus/dexodusv2","credibility":2,"archive_timestamp":"2026-05-13T00:11:02+00:00"},{"url":"https://www.halborn.com/audits/dexodus","name":"Halborn Audit Reports — Dexodus listing","type":"other","archive_url":"http://web.archive.org/web/20260315164415/https://www.halborn.com/audits/dexodus","credibility":2,"archive_timestamp":"2026-03-15T16:44:15+00:00"},{"url":"https://olympix.substack.com/p/419k-could-have-been-saved-if-only","name":"419k Could Have Been Saved — Olympix Substack","type":"research","archive_url":"https://web.archive.org/web/20260819150921/https://olympix.substack.com/p/419k-could-have-been-saved-if-only","credibility":2,"archive_timestamp":"2026-08-19T15:09:21+00:00"},{"url":"https://defillama.com/protocol/dexodus-finance","name":"Dexodus Finance TVL Stats — DeFiLlama","type":"research","archive_url":"http://web.archive.org/web/20250916072632/https://defillama.com/protocol/dexodus-finance","credibility":2,"archive_timestamp":"2025-09-16T07:26:32+00:00"},{"url":"https://tracxn.com/d/companies/dexodus/__zdky1RGiu4H__hbUCIbACv0IrffrxdueStGtghorcU0","name":"Dexodus — Tracxn Company Profile","type":"other","archive_url":"https://web.archive.org/web/20260819172930/https://tracxn.com/d/companies/dexodus/__zdky1RGiu4H__hbUCIbACv0IrffrxdueStGtghorcU0#competitors-and-alternates","credibility":2,"archive_timestamp":"2026-08-19T17:29:30+00:00"},{"url":"https://rocketreach.co/dexodus-finance-management_b6973982c97b67de","name":"Dexodus Finance Management Team — RocketReach","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://blockchain.news/flashnews/dexodus-finance-launches-phase-3-of-private-mainnet-for-perpetual-trading","name":"Dexodus Finance Phase 3 Launch — Blockchain.news","type":"news_article","archive_url":"http://web.archive.org/web/20260819125346/https://blockchain.news/flashnews/dexodus-finance-launches-phase-3-of-private-mainnet-for-perpetual-trading","credibility":2,"archive_timestamp":"2026-08-19T12:53:46+00:00"},{"url":"https://pump.fun/coin/9eEcioewNN6hcvRsYAT5UPko4R4gfLgz9XQhGRPqpump","name":"Dexodus Finance (DXF) — Pump.fun","type":"on_chain","archive_url":"https://web.archive.org/web/20260819172927/https://pump.fun/coin/9eEcioewNN6hcvRsYAT5UPko4R4gfLgz9XQhGRPqpump","credibility":3,"archive_timestamp":"2026-08-19T17:29:27+00:00"},{"url":"https://x.com/DexodusFinance/status/1927323039361913077","name":"Dexodus Finance — X account technical incident statement","type":"social_media","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://web3secnews.substack.com/p/crypto-hacks-soar-mays-647m-meltdown","name":"Crypto Hacks Soar: May 2025 Breakdown — Web3SecNews Substack","type":"news_article","archive_url":"https://web.archive.org/web/20260819194914/https://web3secnews.substack.com/p/crypto-hacks-soar-mays-647m-meltdown","credibility":2,"archive_timestamp":"2026-08-19T19:49:14+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:23.391097+00:00","updated_at":"2026-08-22T17:23:34.85575+00:00"}}