{"investigation":{"slug":"monox","entity_name":"MonoX","trust_score":10,"severity_base":null,"score_modifier":0,"confidence":1,"status":"published","content_type":"investigation","summary":"MonoX was a decentralized exchange protocol built on Ethereum and Polygon using a novel single-token liquidity model, which raised $5M in September 2021 and launched mainnet shortly before suffering a critical smart contract exploit on November 30, 2021. The attacker exploited a missing validation check in the swap function — using the MONO token as both input and output — to artificially inflate its price and drain approximately $31M in user funds across both chains. The protocol attempted a relaunch via MonoX 2.0 with a debt-token compensation mechanism, but MONO has since collapsed to near-zero value with negligible trading activity.","sections":[{"content":"MonoX was founded by Ruyi Ren (CEO) and a co-founder with prior experience at ConsenSys. Headquartered in Singapore, the protocol introduced a single-token liquidity pool model in which deposited tokens are paired with a virtual stablecoin (vCASH / vUNIT) rather than requiring two-sided liquidity. This design aimed to reduce impermanent loss and lower capital requirements for liquidity providers. In September 2021, MonoX closed a $5M funding round led by Krypital Group, with participation from Animoca Brands, Axia8 Ventures, Divergence Ventures, Rarestone Capital, LD Capital, Youbi Capital, GenBlock Capital, OP Crypto, and Blockdream. The mainnet launched in Q4 2021 on Ethereum and Polygon, with full swap and liquidity features. Prior to launch, the protocol underwent smart contract audits by PeckShield and Halborn.","heading":"Background","sources":[{"url":"https://cointelegraph.com/news/monox-raise-5m-to-launch-single-token-liquidity-pools","name":"","type":"other","credibility":3},{"url":"https://cryptoslate.com/press-releases/monox-raises-5-million-to-disrupt-traditional-dexs-using-single-sided-liquidity-pools/","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 30, 2021, an attacker exploited a critical flaw in MonoX's Monoswap smart contract, draining approximately $31M in user funds across Ethereum and Polygon. The vulnerability resided in the _updateTokenInfo function, which updated token prices following swaps but contained no check preventing the same token from being used as both tokenIn and tokenOut in a single transaction. By invoking swapExactTokenForToken with the MONO token as both the input and output token, the price update for tokenOut (MONO as the purchased asset) overwrote the price update for tokenIn (MONO as the sold asset) on each call. The attacker repeated this swap approximately 55 times, compounding the artificial price appreciation of MONO with each iteration. After inflating MONO's price to a very high level, the attacker used the overvalued MONO to purchase all other assets held in the protocol's liquidity pools. Two coordinated attacks occurred: the Polygon attack drained approximately $19.4M, followed approximately 17 minutes later by an Ethereum attack draining approximately $12M. Despite two independent audits by PeckShield and Halborn conducted prior to launch, neither firm identified this vulnerability in the swap validation logic. A dispute arose between MonoX and Halborn after the exploit: Halborn released a screenshot claiming to have flagged the flaw pre-launch, while MonoX countered that Halborn had cropped the image and had previously confirmed that the specific vulnerability had been resolved.","heading":"The Price Inflation Exploit","sources":[{"url":"https://rekt.news/monox-rekt","name":"","type":"other","credibility":3},{"url":"https://slowmist.medium.com/detailed-analysis-of-the-31-million-monox-protocol-hack-574d8c44a9c8","name":"","type":"other","credibility":3},{"url":"https://immunebytes.com/blog/monox-hack-incident-nov-30-2021-detailed-analysis/","name":"","type":"other","credibility":3},{"url":"https://cryptobriefing.com/monox-finance-drained-of-31m-in-latest-defi-hack/","name":"","type":"other","credibility":3},{"url":"https://changenow.io/blog/monox-hacked-amidst-security-audit-mixup","name":"","type":"other","credibility":3},{"url":"https://www.schneier.com/blog/archives/2021/12/smart-contract-bug-results-in-31-million-loss.html","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"The exploit was executed via two attacker-controlled contracts and a shared receiving address. On Polygon, the attack contract was 0x119914de3ae03256fd58b66cd6b8c6a12c70cfb2, with the primary exploit transaction hash 0x5a03b9c03eedcb9ec6e70c6841eaa4976a732d050a6218969e39483bb3004d5d. On Ethereum, the attack contract was 0xf079d7911c13369e7fd85607970036d2883afcfd, with the primary exploit transaction hash 0x9f14d093a2349de08f02fc0fb018dadb449351d0cdb7d0738ff69cc6fef5f299. Stolen funds from both chains were consolidated to address 0x8f6a86f3ab015f4d03ddb13abb02710e6d7ab31b. Assets stolen included approximately 3,900 WETH (valued at ~$18.2M), 5.7M WMATIC (~$10.5M), 36.1 WBTC (~$2M), along with smaller amounts of LINK, GHST, DUCK, MIM, IMX, and USDC/USDT, bringing the total loss to approximately $31–34M depending on price calculations at the time of the attack. The attacker did not use a flash loan; the exploit was executed using ordinary token swaps leveraging the contract's broken price-update logic. The MONO token contract on Ethereum is tracked at 0x2920f7d6134f4669343e70122cA9b8f19Ef8fa5D.","heading":"On-Chain Evidence","sources":[{"url":"https://rekt.news/monox-rekt","name":"","type":"other","credibility":3},{"url":"https://slowmist.medium.com/detailed-analysis-of-the-31-million-monox-protocol-hack-574d8c44a9c8","name":"","type":"other","credibility":3},{"url":"https://etherscan.io/token/0x2920f7d6134f4669343e70122cA9b8f19Ef8fa5D","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"Within 24 hours of the exploit, the MonoX team paused the contract, attempted on-chain contact with the attacker, coordinated with centralized exchanges to monitor stolen fund movements, filed a police report, and engaged security advisors. A $1M insurance policy from Tidal Finance was in place at the time of the exploit. The team acknowledged that immediate full restitution of $31M was not feasible and published a compensation plan: if funds could not be recovered by January 3, 2022, the protocol would issue a non-transferable debt token (dMONO) to affected users at $1 per dMONO. A dMONO vault would receive MONO tokens purchased using future protocol revenue, and dMONO holders could redeem from the vault by burning dMONO. The team also committed to forfeiting their own token vesting until the community was made whole. MonoX subsequently relaunched as MonoX 2.0 with bonds and pools functionality, and announced a build on Avalanche. However, MONO's price collapsed from an all-time high of approximately $2.18 (January 4, 2022) to near zero, and as of 2024–2025 the token trades on a single exchange (HTX/Huobi) with negligible volume and no confirmed evidence of material restitution to affected users. The attacker's funds were not recovered.","heading":"Recovery","sources":[{"url":"https://medium.com/monoswap/exploit-post-mortem-33921a779b43","name":"","type":"other","credibility":3},{"url":"https://medium.com/monoswap/the-path-forward-part-2-community-compensation-951d94cb8e65","name":"","type":"other","credibility":3},{"url":"https://medium.com/monoswap/monox-2-0-is-live-78bde762c892","name":"","type":"other","credibility":3}],"severity":"medium"},{"content":"MonoX represents a textbook case of a critical smart contract vulnerability that escaped multiple independent audits. The missing same-token swap validation is a simple logical check whose absence allowed a low-complexity attack with no flash loan dependency, making the failure particularly notable. The audit dispute between Halborn and MonoX remains unresolved and raises questions about the audit process and how disclosed risks were communicated and acted upon. Affected users — spanning 406 Ethereum addresses and 15,523 Polygon addresses — have not received full restitution based on publicly available evidence. The debt-token (dMONO) compensation mechanism has not demonstrably made affected users whole given the near-zero MONO price and minimal protocol revenue. The protocol continues to exist in a functionally dormant state with negligible liquidity, trading activity, and community engagement. Any interaction with MonoX contracts or MONO/dMONO tokens carries a high risk of total loss of funds. This investigation assigns a trust score of 10 out of 100.","heading":"Risk Assessment","sources":[{"url":"https://rekt.news/monox-rekt","name":"","type":"other","credibility":3},{"url":"https://www.halborn.com/audits/monox","name":"","type":"other","credibility":3},{"url":"https://medium.com/monoswap/exploit-post-mortem-33921a779b43","name":"","type":"other","credibility":3},{"url":"https://beincrypto.com/monox-finance-defi-protocol-exploited-31-million/","name":"","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2021-09-17","event":"MonoX closes $5M funding round led by Krypital Group with participation from Animoca Brands and other investors.","source":""},{"date":"2021-10","event":"MonoX undergoes smart contract audits by PeckShield and Halborn prior to mainnet launch.","source":"","date_original":"2021-10-01"},{"date":"2021-11","event":"MonoX mainnet launches on Ethereum and Polygon with swap and single-token liquidity features.","source":"","date_original":"2021-11-01"},{"date":"2021-11-30","event":"Attacker exploits the _updateTokenInfo function by swapping MONO-for-MONO approximately 55 times across Polygon (~$19.4M) and Ethereum (~$12M), draining ~$31M total in user funds.","source":""},{"date":"2021-12","event":"MonoX team publishes exploit post-mortem, pauses contract, files police report, and begins coordinating with exchanges to monitor stolen funds. SlowMist and ImmuneBytes publish technical analyses.","source":"","date_original":"2021-12-01"},{"date":"2021-12","event":"Dispute emerges between Halborn and MonoX regarding whether the vulnerability was flagged in the pre-launch audit.","source":"","date_original":"2021-12-01"},{"date":"2022-01-03","event":"Deadline for fund recovery passes; MonoX introduces dMONO debt-token compensation plan for affected users.","source":""},{"date":"2022-01-04","event":"MONO token reaches all-time high of approximately $2.18 before beginning a sustained collapse.","source":""},{"date":"2022","event":"MonoX 2.0 relaunches with bonds and pools functionality; team commits to revenue-driven buybacks for dMONO vault.","source":"","date_original":"2022-01-01"},{"date":"2024","event":"MONO token trades on a single exchange (HTX) with near-zero volume and price; protocol is functionally dormant with no confirmed full restitution to affected users.","source":"","date_original":"2024-01-01"}],"sources_used":[{"url":"https://cointelegraph.com/news/monox-raise-5m-to-launch-single-token-liquidity-pools","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830083829/https://cointelegraph.com/news/monox-raise-5m-to-launch-single-token-liquidity-pools","credibility":3,"archive_timestamp":"2026-08-30T08:38:29+00:00"},{"url":"https://cryptoslate.com/press-releases/monox-raises-5-million-to-disrupt-traditional-dexs-using-single-sided-liquidity-pools/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251011203057/https://cryptoslate.com/press-releases/monox-raises-5-million-to-disrupt-traditional-dexs-using-single-sided-liquidity-pools/","credibility":3,"archive_timestamp":"2025-10-11T20:30:57+00:00"},{"url":"https://rekt.news/monox-rekt","name":"","type":"other","archive_url":"http://web.archive.org/web/20260503004437/https://rekt.news/monox-rekt","credibility":3,"archive_timestamp":"2026-05-03T00:44:37+00:00"},{"url":"https://slowmist.medium.com/detailed-analysis-of-the-31-million-monox-protocol-hack-574d8c44a9c8","name":"","type":"other","archive_url":"http://web.archive.org/web/20260502044138/https://slowmist.medium.com/detailed-analysis-of-the-31-million-monox-protocol-hack-574d8c44a9c8","credibility":3,"archive_timestamp":"2026-05-02T04:41:38+00:00"},{"url":"https://immunebytes.com/blog/monox-hack-incident-nov-30-2021-detailed-analysis/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251016180704/https://immunebytes.com/blog/monox-hack-incident-nov-30-2021-detailed-analysis/","credibility":3,"archive_timestamp":"2025-10-16T18:07:04+00:00"},{"url":"https://cryptobriefing.com/monox-finance-drained-of-31m-in-latest-defi-hack/","name":"","type":"other","archive_url":"http://web.archive.org/web/20251222014216/https://cryptobriefing.com/monox-finance-drained-of-31m-in-latest-defi-hack/","credibility":3,"archive_timestamp":"2025-12-22T01:42:16+00:00"},{"url":"https://changenow.io/blog/monox-hacked-amidst-security-audit-mixup","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.schneier.com/blog/archives/2021/12/smart-contract-bug-results-in-31-million-loss.html","name":"","type":"other","archive_url":"http://web.archive.org/web/20251210153849/https://www.schneier.com/blog/archives/2021/12/smart-contract-bug-results-in-31-million-loss.html","credibility":3,"archive_timestamp":"2025-12-10T15:38:49+00:00"},{"url":"https://etherscan.io/token/0x2920f7d6134f4669343e70122cA9b8f19Ef8fa5D","name":"","type":"other","archive_url":"https://web.archive.org/web/20260830085352/https://etherscan.io/token/0x2920f7d6134f4669343e70122cA9b8f19Ef8fa5D","credibility":3,"archive_timestamp":"2026-08-30T08:53:52+00:00"},{"url":"https://medium.com/monoswap/exploit-post-mortem-33921a779b43","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/monoswap/the-path-forward-part-2-community-compensation-951d94cb8e65","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/monoswap/monox-2-0-is-live-78bde762c892","name":"","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.halborn.com/audits/monox","name":"","type":"other","archive_url":"http://web.archive.org/web/20260414135424/https://www.halborn.com/audits/monox","credibility":3,"archive_timestamp":"2026-04-14T13:54:24+00:00"},{"url":"https://beincrypto.com/monox-finance-defi-protocol-exploited-31-million/","name":"","type":"other","archive_url":"http://web.archive.org/web/20260118100756/https://beincrypto.com/monox-finance-defi-protocol-exploited-31-million/","credibility":3,"archive_timestamp":"2026-01-18T10:07:56+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:53.048622+00:00","updated_at":"2026-08-30T20:47:33.528711+00:00"}}