Fact-check findings

No source the reviewer could reach confirms or contradicts the claim.

1. #3[unverifiable][awaiting moderator]in section: October 2025 Exploit — Flash Loan Oracle Manipulation

   “Approximately $40,000 of the stolen funds was subsequently recovered.”

   reviewerAbout $40,000 of the stolen funds was recoveredTwo cited sources I read do not mention a recovery. I did not check Blockthreat or de.fi for it.
2. #6[unverifiable][awaiting moderator]in section: Security Researcher Attention and Community Response

   “The entity is flagged by ZachXBT-associated monitoring networks as a protocol that suffered a preventable exploit due to the failure to implement known security fixes.”

   reviewerExploit flagged by ZachXBT-associated monitoring networksNo cited source mentions ZachXBT, and my searches found nothing. The wording is vague and implies an endorsement that is not shown. The summary repeats it.
3. #7[unverifiable][awaiting moderator]in the summary

   “The protocol was flagged by on-chain security researchers including ZachXBT-adjacent monitoring networks”

   reviewerSummary repeats the ZachXBT-adjacent flagSame unsupported attribution as in sections[4]. BlockSec Phalcon is the documented source.
4. #11[unverifiable][awaiting moderator]in the timeline

   “Verichains publishes vulnerability analysis of the Sharwa Finance exploit, confirming the oracle manipulation vector and noting the prior Pashov audit finding.”

   reviewerVerichains published its analysis on 2025-10-27 and FailSafe on 2025-10-23The Verichains publication date was not shown. The FailSafe date of Oct 23 matches.
   citedblog.verichains.io/p/vulnerability-analy…s-deconstructing

The claim was accurate when written but events since have overtaken it.

1. #9[stale][awaiting moderator]in section: Current Status and Risk Assessment

   “The protocol is ranked approximately #402 among derivatives protocols by TVL”

   reviewerTVL about $3,944 and rank #402 among derivatives protocols as of late May 2026Dated figures that later data has overtaken. I got the newer rank from a search summary only, not a fetched page. TVL of about $3,944 is likewise out of date (about $3.30 now), but the page dates it to late May 2026.
   Proposed correction (not yet applied)

   The protocol is ranked approximately #265 among derivatives protocols by TVL
   citeddefillama.com/protocol/sharwa.finance

The cited evidence supports part of the claim but not all of it.

1. #5[partially supported][awaiting moderator]in section: Prior Audit Findings and Failure to Remediate

   “the fix for the known oracle vulnerability had not been applied to the newly deployed contract, nor had the new deployment undergone a re-audit”

   reviewerFix for the known oracle vulnerability had not been applied to the new deploymentThe 18-day deployment and the lack of re-review are supported. The Verichains article says the finding was marked resolved and does not say the fix was dropped from the new contract. The page states that as fact.
   citedblog.verichains.io/p/vulnerability-analy…s-deconstructing
2. #10[partially supported][awaiting moderator]in section: October 2025 Exploit — Flash Loan Oracle Manipulation

   “committed to 100% reimbursement of affected users”

   reviewerTeam's reimbursement commitment and Reduce-Only mode, announced on XSupported by a secondary case study. The X post-mortem was not directly checked.
   citedquadrigainitiative.com/casestudy/sharwaf…solvencyflaw.php

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in section: October 2025 Exploit — Flash Loan Oracle Manipulation

   “resulting in losses of approximately $147,000 from its WETH and WBTC liquidity pools”

   reviewerExploit of about $147,000 via flash loan oracle manipulation on October 20, 2025, from WETH and WBTC pools, with Morpho USDC flash loan and listed attacker addressesDate, amount, pools, addresses and attack flow match Verichains.
   citedblog.verichains.io/p/vulnerability-analy…s-deconstructing
2. #2[confirmed][no action needed]in section: October 2025 Exploit — Flash Loan Oracle Manipulation

   “contributing approximately $61,000 and $85,000 respectively to the total loss figure”

   reviewerFailSafe attributes about $61,000 and $85,000 to two attackers due to missing insolvency checksMatches. FailSafe gives no total; the two figures sum to about $146K.
   citedgetfailsafe.com/sharwafinance-exploit-analysis/
3. #4[confirmed][no action needed]in section: Prior Audit Findings and Failure to Remediate

   “The audit identified a total of four critical-severity findings and five high-severity findings”

   reviewerPashov audit C-01 flagged Uniswap spot price manipulation; 4 critical and 5 high findings; Chainlink recommendedCounts and titles match. The June 17, 2024 date could not be seen in the fetch.
   citedgithub.com/pashov/audits/blob/master/tea…curity-review.md
4. #8[confirmed][no action needed]in section: Second Incident — May 2026

   “Sharwa.Finance recorded a second security incident on May 1, 2026, resulting in approximately $32,850 in losses attributed to oracle price manipulation on the Arbitrum network.”

   reviewerSecond incident May 1, 2026, about $32,850 oracle manipulation per DefiLlamaConfirmed only through a search summary, because the DefiLlama fetch was blocked. Single aggregator source.
   citeddefillama.com/protocol/sharwa.finance