Verify a decision

{"actor":"system:backfill","investigation_id":"342a7854-c8c7-4e8c-9c51-13d241b3f746","kind":"publish","page_slug":"set-protocol","published_at":"2026-10-09T20:20:21.322Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"Set Protocol","sections":[{"content":"On October 6, 2026, crypto news outlets reported that Set Protocol suffered a smart contract exploit resulting in a loss of approximately 5.08 ETH (reported as roughly $21,000 at the time). The reporting attributes the flaw to the protocol's actualizeFee() function, alleging that a rounding error in fee calculations allowed an attacker to redeem collateral that should have been excluded from redemption. The coverage originates from coinfomania.com and a syndicated copy on cryptonews.net, both of which credit the initial report to a post from the security firm SlowMist's X (Twitter) account. Neither article includes a transaction hash, attacker wallet address, block number, or a direct statement from Set Protocol, SlowMist, or Index Coop, and no independent post-mortem from a security firm or the protocol team was located. The amount and mechanism should be treated as alleged and only partially verified pending a primary disclosure or on-chain confirmation.","heading":"October 2026 actualizeFee() Rounding-Error Exploit","severity":"medium","sources":[{"credibility":3,"name":"Set Protocol Faces ~5.08 ETH Exploit Loss Amid Security Flaw (coinfomania.com)","type":"news_article","url":"https://coinfomania.com/set-protocol-faces-5-08-eth-exploit-loss-amid-security-flaw/"},{"credibility":3,"name":"Set Protocol Faces ~5.08 ETH Exploit Loss Amid Security Flaw (cryptonews.net syndication)","type":"news_article","url":"https://cryptonews.net/news/security/33546462/"}]},{"content":"The alleged actualizeFee() flaw belongs to a broader category of arithmetic-precision or rounding-error vulnerabilities that have affected multiple DeFi protocols. The most significant recent example is the November 3, 2025 exploit of Balancer V2, in which an attacker allegedly exploited a rounding flaw in the protocol's internal scaling function (_upscaleArray) combined with crafted batchSwap operations to deflate the reported value of pool tokens, draining an estimated $100-128 million across several blockchain networks in under two hours, according to Check Point Research and multiple crypto outlets. While the Set Protocol incident is several orders of magnitude smaller, both cases illustrate how integer rounding and precision-loss bugs in fee or pricing calculations can be weaponized to extract value from DeFi protocols. This context is provided for background on the vulnerability class and does not establish a technical or causal link between the two codebases.","heading":"Vulnerability Class Context: Rounding-Error Exploits in DeFi","severity":"medium","sources":[{"credibility":2,"name":"How an Attacker Drained $128M from Balancer Through Rounding Error Exploitation (Check Point Research)","type":"research","url":"https://research.checkpoint.com/2025/how-an-attacker-drained-128m-from-balancer-through-rounding-error-exploitation/"},{"credibility":2,"name":"Balancer Exploited for $128 Million Across Ethereum Chains as Berachain Halts Network (Decrypt)","type":"news_article","url":"https://decrypt.co/347173/balancer-exploited-128-million-across-ethereum-chains-berachain-halts"}]},{"content":"Coinfomania also published a separate, undated report describing an earlier loss of approximately $9,600 tied to an exploit of the ExchangeIssuance function used by Index Coop, a decentralized cooperative that builds tokenized index products on top of Set Protocol's infrastructure. That report alleges a malicious manager role was used to inflate unit counts via a pre-issuance hook. This is a distinct incident from the October 2026 actualizeFee() exploit, involves a different component (Index Coop's issuance tooling rather than Set Protocol's core fee logic), and its date could not be independently confirmed. It is included here only as background indicating that components built on or alongside Set Protocol's infrastructure have had more than one reported small-scale exploit.","heading":"Prior Smart Contract Exploit Involving Index Coop's ExchangeIssuance","severity":"low","sources":[{"credibility":3,"name":"SetProtocol Faces $9.6K Loss Due to Exploit in Smart Contract (coinfomania.com)","type":"news_article","url":"https://coinfomania.com/es/setprotocol-faces-9-6k-loss-due-to-exploit-in-smart-contract-es/"}]},{"content":"Set Protocol was built by Set Labs, a San Francisco-based company, with sources crediting Felix Feng, Inje Yeo, and Alex Soong as founders; one 2019 interview quotes Inje Yeo describing himself as co-founder and Chief Product Officer. Reported funding figures vary across sources between roughly $2 million and $2.2 million raised from investors including Craft Ventures, DFJ, Social Capital, and others, with the seed round variously dated to late 2018. The protocol's consumer-facing product, TokenSets, reportedly launched on Ethereum mainnet around April 2019. In September 2020, Set helped incubate Index Coop, a decentralized cooperative that uses Set Protocol's smart contract infrastructure to issue and manage tokenized index products such as DPI; sources note the organizational lines between Set Protocol and Index Coop can be blurred, as Index Coop does not operate as a traditional centralized team but governs itself through the INDEX token.","heading":"Background: Protocol Origins and Structure","severity":"low","sources":[{"credibility":2,"name":"Interview with TokenSets creators","type":"other","url":"https://defiprime.com/tokensets"},{"credibility":3,"name":"Episode 189: Interview with Felix Feng","type":"other","url":"https://aroundthecoin.com/podcast/episode-189-interview-with-felix-feng/"},{"credibility":2,"name":"DeFi is About to Get More Tokenized Indexes (The Defiant)","type":"news_article","url":"https://thedefiant.io/news/defi/defi-is-about-to-get-more-tokenized-indexes"}]}],"sources_used":[{"credibility":3,"name":"Set Protocol Faces ~5.08 ETH Exploit Loss Amid Security Flaw (coinfomania.com)","type":"news_article","url":"https://coinfomania.com/set-protocol-faces-5-08-eth-exploit-loss-amid-security-flaw/"},{"credibility":3,"name":"Set Protocol Faces ~5.08 ETH Exploit Loss Amid Security Flaw (cryptonews.net syndication)","type":"news_article","url":"https://cryptonews.net/news/security/33546462/"},{"credibility":3,"name":"SetProtocol Faces $9.6K Loss Due to Exploit in Smart Contract (coinfomania.com)","type":"news_article","url":"https://coinfomania.com/es/setprotocol-faces-9-6k-loss-due-to-exploit-in-smart-contract-es/"},{"credibility":2,"name":"How an Attacker Drained $128M from Balancer Through Rounding Error Exploitation (Check Point Research)","type":"research","url":"https://research.checkpoint.com/2025/how-an-attacker-drained-128m-from-balancer-through-rounding-error-exploitation/"},{"credibility":2,"name":"Balancer Exploited for $128 Million Across Ethereum Chains as Berachain Halts Network (Decrypt)","type":"news_article","url":"https://decrypt.co/347173/balancer-exploited-128-million-across-ethereum-chains-berachain-halts"},{"credibility":2,"name":"Interview with TokenSets creators","type":"other","url":"https://defiprime.com/tokensets"},{"credibility":3,"name":"Episode 189: Interview with Felix Feng","type":"other","url":"https://aroundthecoin.com/podcast/episode-189-interview-with-felix-feng/"},{"credibility":2,"name":"DeFi is About to Get More Tokenized Indexes (The Defiant)","type":"news_article","url":"https://thedefiant.io/news/defi/defi-is-about-to-get-more-tokenized-indexes"}],"summary":"Set Protocol is an Ethereum-based smart contract system for creating and managing tokenized baskets of assets (\"Sets\"), originally launched by Set Labs in 2019 and later used as the underlying infrastructure for Index Coop's tokenized index products. On October 6, 2026, the protocol allegedly suffered a smart-contract exploit of approximately 5.08 ETH (roughly $21,000) tied to a rounding-error flaw in its actualizeFee() function, according to thinly-sourced crypto news coverage citing a social media post from SlowMist. The loss is small in absolute terms but belongs to the same arithmetic-precision vulnerability class implicated in larger DeFi incidents, including the November 2025 Balancer exploit.","timeline":[{"date":"2018","event":"Set Labs reportedly raises a seed round of roughly $2-2.2 million from investors including Craft Ventures, DFJ, and Social Capital.","source":"DeFi Prime / Dealroom profiles","source_url":"https://defiprime.com/tokensets"},{"date":"2019-04","event":"TokenSets, the consumer product built on Set Protocol, reportedly launches on Ethereum mainnet.","source":"Set Protocol company profile","source_url":"https://defiprime.com/tokensets"},{"date":"2020-09","event":"Index Coop launches in partnership with DeFi Pulse, incubated by Set, using Set Protocol's smart contracts to issue tokenized index products.","source":"The Defiant","source_url":"https://thedefiant.io/news/defi/defi-is-about-to-get-more-tokenized-indexes"},{"date":"2025-11","date_evidence":"Verichains says the Balancer V2 protocol was exploited on that date","date_original":"2025-11-03","event":"Balancer V2 is exploited for an estimated $100-128 million via a rounding-error flaw in a scaling function combined with crafted batchSwap operations; cited as context for the same vulnerability class.","source":"Check Point Research / Decrypt","source_url":"https://research.checkpoint.com/2025/how-an-attacker-drained-128m-from-balancer-through-rounding-error-exploitation/"},{"date":"2026-10-06","date_evidence":"The article is dated 06 October 2026, 12:54 UTC","event":"Set Protocol allegedly suffers a smart contract exploit of approximately 5.08 ETH (~$21,000) via a rounding-error flaw in its actualizeFee() function, per crypto news coverage citing a SlowMist social media post.","source":"cryptonews.net / coinfomania.com","source_url":"https://cryptonews.net/news/security/33546462/"}]},"v":1}