{"investigation":{"slug":"skyward-finance","entity_name":"Skyward Finance","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Skyward Finance was a permissionless token launchpad built on the NEAR Protocol, launched in June 2021. On November 2, 2022, a smart contract vulnerability in its treasury redemption function was exploited, resulting in the loss of approximately 1.1 million NEAR tokens (~$3.2 million USD). The exploit rendered the SKYWARD token and protocol treasury effectively worthless, and the team publicly advised users to withdraw all remaining funds and cease interacting with the platform.","sections":[{"content":"Skyward Finance operated as a permissionless, open-source token launchpad on the NEAR Protocol blockchain. Its stated mission was to enable fair token distribution and price discovery for projects building on NEAR, using a streaming time-based auction mechanism intended to reduce opportunities for insider favoritism and front-running attacks common in traditional token launches. The platform launched on NEAR mainnet on June 24, 2021. The project was developed under pseudonyms drawn from Brandon Sanderson's Skyward science fiction novel series. No audit of the smart contracts by a third-party security firm has been confirmed in publicly available records prior to the November 2022 exploit.","heading":"Overview","sources":[{"url":"https://medium.com/nearprotocol/everything-you-need-to-know-about-skyward-finance-before-the-first-token-sale-6e82fe305e1a","name":"medium.com","type":"other","credibility":3},{"url":"https://rekt.news/skyward-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"},{"content":"On November 2, 2022, an unknown attacker exploited a critical vulnerability in Skyward Finance's treasury smart contract, draining approximately 1.1 million wrapped NEAR (wNEAR) tokens valued at roughly $3.2 million USD at the time of the incident. The vulnerability resided in the contract's redeem_skyward function, which is used to redeem the protocol treasury. The function failed to validate whether token_account_ids parameters supplied by the caller were unique; it verified validity but not uniqueness. The attacker purchased SKYWARD tokens on Ref.Finance (an AMM on NEAR), then called the redeem_skyward function with duplicate token account ID arguments in a single transaction, causing the contract to loop redemptions and pay out wNEAR multiple times against a single set of SKYWARD tokens. The entire treasury was drained in a single transaction. The attack was first identified by a community member using the handle Nearscout, and subsequently analyzed by blockchain security firm BlockSec. The exploit was the first NEAR-ecosystem project to appear on the Rekt DeFi leaderboard. Security firm Halborn noted the vulnerability was preventable through standard pre-deployment smart contract auditing. Rekt.news observed that 'the fact that it took over a year for anyone to find this relatively simple exploit is remarkable,' and raised the question of whether the incident represented an honest mistake or an intentional design. No funds were reported recovered. The attacker's address on-chain is 5ebc5ecca14a44175464d0e6a7d3b2a6890229cd5f19cfb29ce8b1651fd58d39.","heading":"Smart Contract Exploit — November 2022","sources":[{"url":"https://rekt.news/skyward-rekt","name":"rekt.news","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-skyward-finance-hack-november-2022","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.theblock.co/post/182495/skyward-finance-exploit-near-protocol","name":"theblock.co","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/skyward-finance-exploit-allegedly-results-in-3-million-loss","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://quillaudits.medium.com/decoding-skywardfinance-3-million-exploit-quillaudits-9725727f94b0","name":"quillaudits.medium.com","type":"other","credibility":3},{"url":"https://medium.com/neptune-mutual/decoding-skyward-finance-smart-contract-vulnerability-3e38c5d0e312","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the exploit, the SKYWARD token price declined approximately 90–95% within hours of the attack becoming public. The Skyward Finance team issued a public statement acknowledging that the exploit had 'render[ed] the Treasury and the $SKYWARD token effectively worthless.' The team clarified that ongoing and past token sales hosted on the platform were not directly affected by the treasury drain, but strongly recommended that all users withdraw remaining funds immediately and cease all interaction with the platform. CoinMarketCap subsequently tracked the SKYWARD token at or near $0 USD, and multiple data aggregators flagged the asset as untracked or inactive due to insufficient on-chain activity.","heading":"Token Impact and Market Response","sources":[{"url":"https://cryptopotato.com/skyward-token-dumps-95-as-hackers-drain-protocols-treasury/","name":"cryptopotato.com","type":"other","credibility":3},{"url":"https://www.web3isgoinggreat.com/?id=skyward-finance-treasury-drained-of-3-2-million","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/skyward-finance/","name":"coinmarketcap.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Security researchers at BlockSec, Halborn, QuillAudits, and Neptune Mutual independently analyzed the Skyward Finance vulnerability and reached consistent conclusions: the exploit was caused by a straightforward input validation failure that should have been caught by standard smart contract audit procedures. The redeem_skyward function accepted an array of token account IDs without enforcing uniqueness, a design flaw that permitted unbounded duplicate redemptions within a single call. Halborn noted this class of vulnerability is 'preventable through smart contract audits before deployment.' No pre-deployment audit report for the Skyward Finance smart contracts has been publicly confirmed. Rekt.news also raised community concerns, noting that pre-launch discussions had included speculation about the possibility of funds disappearing, though no specifics were provided in publicly available records.","heading":"Security and Audit Concerns","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-skyward-finance-hack-november-2022","name":"halborn.com","type":"other","credibility":3},{"url":"https://quillaudits.medium.com/decoding-skywardfinance-3-million-exploit-quillaudits-9725727f94b0","name":"quillaudits.medium.com","type":"other","credibility":3},{"url":"https://medium.com/neptune-mutual/decoding-skyward-finance-smart-contract-vulnerability-3e38c5d0e312","name":"medium.com","type":"other","credibility":3},{"url":"https://rekt.news/skyward-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"},{"content":"As of 2024–2025, the Skyward Finance protocol is effectively defunct. The SKYWARD token has negligible to zero market value and is listed as inactive or untracked by major data aggregators. The Skyward Finance app domain (app.skyward.finance) remains accessible but no recovery plan or successor protocol has been announced in publicly verifiable sources. No on-chain evidence of treasury recovery or attacker identification has emerged in public reporting. The project represents a complete capital loss for users who held SKYWARD tokens or had funds in the treasury at the time of the exploit.","heading":"Current Status","sources":[{"url":"https://www.web3isgoinggreat.com/?id=skyward-finance-treasury-drained-of-3-2-million","name":"web3isgoinggreat.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/skyward-finance/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.vidma.io/blog/skyward-finance-a-3-2m-lesson-in-smart-contract-vulnerabilities","name":"vidma.io","type":"other","credibility":3}],"severity":"medium"},{"content":"AVOID.NET has flagged this entity as having been noted by blockchain investigator ZachXBT in the context of the NEAR Protocol exploit. Independent confirmation of a specific ZachXBT post or thread directly naming Skyward Finance has not been located in publicly archived sources as of this investigation. The ZachXBT attribution should be treated as low confidence pending a verifiable primary source.","heading":"ZachXBT Flag","sources":[],"severity":"medium"}],"timeline":[{"date":"2021-06-24","event":"Skyward Finance launches on NEAR Protocol mainnet following a test sale period.","source":""},{"date":"2022-11-02","event":"Attacker exploits the redeem_skyward smart contract function, draining approximately 1.1 million wNEAR (~$3.2 million USD) from the Skyward Finance treasury in a single transaction.","source":""},{"date":"2022-11-02","event":"Community member Nearscout first identifies and reports the exploit publicly.","source":""},{"date":"2022-11-03","event":"Skyward Finance team issues public statement confirming the exploit rendered 'the Treasury and the $SKYWARD token effectively worthless' and advises users to withdraw all funds and cease platform interaction.","source":""},{"date":"2022-11-03","event":"SKYWARD token price collapses approximately 90–95%. Skyward Finance becomes the first NEAR ecosystem project on the Rekt DeFi exploit leaderboard.","source":""},{"date":"2022-11-03","event":"BlockSec, Halborn, QuillAudits, and Neptune Mutual publish independent analyses identifying the input validation flaw in the redeem_skyward function.","source":""}],"sources_used":[{"url":"https://medium.com/nearprotocol/everything-you-need-to-know-about-skyward-finance-before-the-first-token-sale-6e82fe305e1a","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://rekt.news/skyward-rekt","name":"rekt.news","type":"other","archive_url":"http://web.archive.org/web/20260518002354/https://rekt.news/skyward-rekt","credibility":3,"archive_timestamp":"2026-05-18T00:23:54+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-skyward-finance-hack-november-2022","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260513004644/https://www.halborn.com/blog/post/explained-the-skyward-finance-hack-november-2022","credibility":3,"archive_timestamp":"2026-05-13T00:46:44+00:00"},{"url":"https://www.theblock.co/post/182495/skyward-finance-exploit-near-protocol","name":"theblock.co","type":"other","archive_url":"http://web.archive.org/web/20260726183902/https://www.theblock.co/post/182495/skyward-finance-exploit-near-protocol","credibility":3,"archive_timestamp":"2026-07-26T18:39:02+00:00"},{"url":"https://cointelegraph.com/news/skyward-finance-exploit-allegedly-results-in-3-million-loss","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260720153207/https://cointelegraph.com/news/skyward-finance-exploit-allegedly-results-in-3-million-loss","credibility":3,"archive_timestamp":"2026-07-20T15:32:07+00:00"},{"url":"https://quillaudits.medium.com/decoding-skywardfinance-3-million-exploit-quillaudits-9725727f94b0","name":"quillaudits.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://medium.com/neptune-mutual/decoding-skyward-finance-smart-contract-vulnerability-3e38c5d0e312","name":"medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://cryptopotato.com/skyward-token-dumps-95-as-hackers-drain-protocols-treasury/","name":"cryptopotato.com","type":"other","archive_url":"https://web.archive.org/web/20260829235312/https://cryptopotato.com/skyward-token-dumps-95-as-hackers-drain-protocols-treasury/","credibility":3,"archive_timestamp":"2026-08-29T23:53:12+00:00"},{"url":"https://www.web3isgoinggreat.com/?id=skyward-finance-treasury-drained-of-3-2-million","name":"web3isgoinggreat.com","type":"other","archive_url":"http://web.archive.org/web/20260414212231/https://www.web3isgoinggreat.com/?id=skyward-finance-treasury-drained-of-3-2-million","credibility":3,"archive_timestamp":"2026-04-14T21:22:31+00:00"},{"url":"https://coinmarketcap.com/currencies/skyward-finance/","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20260613124642/https://coinmarketcap.com/currencies/skyward-finance/","credibility":3,"archive_timestamp":"2026-06-13T12:46:42+00:00"},{"url":"https://www.vidma.io/blog/skyward-finance-a-3-2m-lesson-in-smart-contract-vulnerabilities","name":"vidma.io","type":"other","archive_url":"http://web.archive.org/web/20260418195002/https://www.vidma.io/blog/skyward-finance-a-3-2m-lesson-in-smart-contract-vulnerabilities","credibility":3,"archive_timestamp":"2026-04-18T19:50:02+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:46.731301+00:00","updated_at":"2026-08-30T01:16:32.410985+00:00"}}