Radiant V2
October 16, 2024
Catastrophic access control failure. Admin functions left wide open.
FORENSIC REPORT
Time of Death: October 16, 2024, approximately 14:32 UTC. The specimen arrived at our facility already exsanguinated. Initial scene investigation indicates a singular point-of-failure event—an access control exploit operating with clinical precision on the Binance Smart Chain. The patient never saw it coming.
Cause of Death Analysis: The autopsy reveals the victim's administrative functions were exposed with the security rigor of a bathroom door lock. Critical smart contract functions that should have required multi-signature authentication or timelock mechanisms instead accepted calls from any address. The attacker simply walked through the front door, took the keys, and helped themselves. The specimen shows zero barriers to critical state modifications—withdrawal functions, permission structures, and fund movement all accessible to unauthorized parties. This wasn't a sophisticated cryptographic break; this was someone forgetting to install a lock.
Contributing Factors: The pathology suggests pre-mortem negligence rather than external failure. Code review mechanisms appear absent from the victim's medical history. No apparent access control framework implementation. The project deployed with admin functions callable by any EOA, indicating either gross incompetence or alarming indifference to fundamental security architecture. The specimen's developers never implemented basic authorization checks—the digital equivalent of leaving your front door not just unlocked, but hanging open with a welcome mat.
Victim Impact: $53 million in total fund extraction. Liquidity providers hemorrhaged capital. Token holders witnessed their positions become worthless in real-time. Multiple downstream protocols and yield farms dependent on Radiant V2's solvency experienced cascading failures. This wasn't a contained incident; it was a systemic bleed.
Pathologist's Note: In fifteen years of autopsies, I've seen exploits that demonstrated genuine ingenuity—attackers who found zero-days, crafted multi-step flash loan sequences, exploited economic assumptions. This specimen's death wasn't caused by attacker intelligence; it was caused by deployer stupidity. The access control failures here are so elementary, so fundamentally broken, that I'm genuinely uncertain whether we're examining negligence or outright sabotage. Either way, the corpse is equally dead, and the investors are equally bankrupt. *Closes file.* Next case.
"Radiant V2 suffered complete authorization collapse on BSC, hemorrhaging $53M in fifty-three minutes. Access controls failed so spectacularly, even script kiddies could've done it."
Data from DefiLlama