Tinyman
Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.
anchored·66NfCw…gY4pSummary
Tinyman is an automated market maker (AMM) and decentralized exchange (DEX) built on the Algorand blockchain, launched on mainnet in October 2021. On January 1, 2022, attackers exploited a logic flaw in the protocol's pool-token burn function to drain approximately $3 million in wrapped Bitcoin and Ethereum assets across 43 pools. Tinyman subsequently patched the contracts, launched a compensation program covering all affected liquidity providers, and released a fully re-audited v2.0 protocol in early 2023.
Connected Entities
1 entities · 10 linked investigationsTimeline(10 events)
21 September 2021
Runtime Verification completes initial audit of Tinyman v1 smart contracts
Tinyman Medium7 October 2021
Tinyman launches on Algorand mainnet; raises $2.5M from investors including Borderless Capital, DCG, and BlockTower
CoinDesk2022
Exploit begins at 19:03 UTC; primary attacker executes 16 transactions exploiting burn function logic flaw, stealing approximately $1.8M in goBTC and goETH
Tinyman Technical Report 12 January 2022
Tinyman publishes official incident announcement; warns all liquidity providers to withdraw funds; disables liquidity routes on web app; contacts law enforcement
Tinyman Medium2 January 2022
Total attack scope confirmed: 13 unique attacker addresses, 43 pools drained, 360 malicious transactions, approximately $3M total losses including arbitrage
Tinyman Technical Report 119 January 2022
Tinyman v1.1 relaunches on mainnet with patched contracts; two audit firms reviewed the updated contracts; bug bounty program extended
coin.fyi / Tinyman24 March 2022
Tinyman begins distributing compensation payments to affected liquidity providers; program covers stolen amounts, stuck LP tokens, and arbitraged losses
Tinyman Compensation Program Medium30 November 2022
Tinyman announces v2.0 at Algorand Decipher event in Dubai, featuring Tealish-written contracts, multi-level audit, and Immunefi bug bounty up to $250,000
PR Newswire2023
Tinyman v2.0 mainnet launch (approximate); audited by Runtime Verification at specification, Tealish, and TEAL bytecode levels
Runtime Verification blogDecision Log
- hash: E6mLcYTH3HJuUsuFvemZF6c8kDUtHjph96tAH7YsGZxi
- hash: 6FPfQHPZ1WSKWQNwVACSsWHmbj6dqrnPU6dzHfej1adi
- hash: 5HHrwkzkoCiM7YstQosSFJzrCxj2fR43QcE4ehUC5ewn
This investigation is cryptographically anchored to the Solana blockchain (3 events). 16 of 18 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-5
generated: 5/30/2026, 1:00:19 PM
last updated: 8/29/2026, 1:33:00 AM
avoid.net — verified advice for a post-truth world