Data Sources for the 2026 Ranking¶

The OWASP Smart Contract Top 10 2026 draws on multiple data sources to ensure the ranking reflects both practitioner judgment and real-world incident trends. This page documents those sources and how they inform the final list.

Primary: Practitioner Survey¶

Survey Design¶

A structured, anonymised survey was conducted by OWASP SCS Team to collect practitioner rankings of risk categories. The survey targeted:

Survey Content¶

Respondents were asked to:

1. Assign ranks (1–10) to each risk category, where 1 = highest risk.
2. Describe factors that influenced their ranking (e.g., frequency in production, ease of exploitation, size of losses).
3. Suggest additional or emerging risk categories not captured by the current list.
4. Indicate their confidence in the ranking provided.

Survey Link¶

The survey remains open for ongoing data collection:

Participate in the 2026 Top 10 Survey

Data Handling¶

• Responses are anonymised for public reporting.
• Aggregated insights (e.g., mean ranks, tier distributions) are used to inform the ranking.
• Individual responses or identities are not shared publicly unless explicitly consented.

Secondary: 2025 Incident Data¶

Real-World Incidents¶

The 2026 list is forward-looking and grounded in 2025 security incidents. High-impact breaches and exploit classifications from 2025 were used to:

• Validate and refine the ordering suggested by survey responses
• Identify emerging categories (e.g., Proxy & Upgradeability, Arithmetic Errors)
• Assign appropriate prominence to categories that drove large losses

Incident Databases¶

1. SolidityScan Web3HackHub¶

Comprehensive database of blockchain-related incidents, attack vectors, and financial losses. Documents breaches from 2011 onward.

Learn about Hacks & Prevent Attacks

2. SlowMist Web3 Hacked¶

SlowMist's curated database of Web3 security incidents and hacks.

SlowMist Hacked

3. DeFi Attack Vectors for 2025 (Video)¶

Video analysis of the top DeFi attack vectors by risk for 2025.

Watch on YouTube

4. DeFiHackLabs Incident Explorer¶

Explore and analyse DeFi hack incidents. Reproduce incidents using Foundry via GitHub.

DeFi Hack Incidents Explorer

5. BlockSec Security Incident Library¶

Crypto security incidents library with searchable incident data.

BlockSec Security Incidents

Other References¶

2025 Incident Categories (Illustrative)¶

Incident data from 2025 highlighted the following categories as drivers of major losses:

• Access Control: Balancer V2 (~$128M), Zoth ($8.4M)
• Business Logic: Abracadabra ($12.9M), Yearn Finance ($9M)
• Price Oracle Manipulation: NGP Token (~$2M), GMX (oracle component of $42M)
• Flash Loan–Facilitated: Bunni ($8.4M), zkLend ($9.5M)
• Lack of Input Validation: Cetus ($223M), Ionic Money (~$6.9M)
• Unchecked External Calls / Reentrancy: GMX ($42M), Cork Protocol ($12M)
• Arithmetic Errors: zkLend ($9.5M), Bunni ($8.4M)
• Integer Overflow: Cetus ($223M on Sui/Move)
• Proxy & Upgradeability: ResupplyFi ($9.8M)

These figures informed the relative weighting and inclusion of categories in the final 2026 Top 10.

Total Lost Value (TLV) Reports¶

The following reports provide aggregated data on total value lost to exploits, hacks, and fraud in Web3. They are used to contextualise incident impact and validate category prominence.

1. SolidityScan / CredShields 2025 Annual Report — State of Web3 Security 2025¶

View on Google Drive

2. Beosin 2025 Global Web3 Security Report¶

Download PDF

2025 Web3 total losses: $3.375B across 313 incidents (hacks, phishing, rug pulls).

3. SlowMist Blockchain Security and AML Annual Report 2025¶

Download PDF

Distribution of causes for security incidents in 2025—contract vulnerability, account compromise, oracle attacks, and more.

4. HackenProof Web3 Security Report 2025¶

HackenProof's Web3 security report for 2025. DocSend viewer—open in new tab for full document preview.

View HackenProof Report

5. QuillAudits Exploited Ledgers: The Web3 Hack Report 2025¶

QuillAudits' annual report on exploited DeFi protocols. DocSend viewer—open in new tab for full document preview.

View QuillAudits Report

6. ScamSniffer 2025: Crypto Phishing Losses Fall 83% to $84 Million¶

Read on Scam Sniffer

Tertiary: Qualitative and Expert Input¶

Free-Text Survey Responses¶

Qualitative responses from the survey were analysed for recurring themes:

• Upgradeability and proxy risk
• Economic and incentive design flaws
• Cross-chain and bridge failures
• Supply-chain and dependency risks
• Operational and governance failures

Expert Review¶

Community maintainers and contributors reviewed the preliminary statistical ordering against:

• Practitioner narratives from the survey
• Published security research and DeFi attack summaries
• Alignment with OWASP and industry terminology

2025 Incident Data Summary¶

Data Sources¶

Total analyzed: 122 unique protocols (deduplicated across SolidityScan, BlockSec, SlowMist)
Total loss: $905.4M (smart-contract-vector only; excludes phishing, CEX, rugpulls)

Note: DeFiHackLabs provides proof-of-concept reproductions and incident documentation but is not included in the calculated totals table. It serves as a validation source—incidents appearing in DeFiHackLabs (e.g., HegicOptions $104M, MIM_Spell $1.7M–$13.4M) are cross-referenced with other sources. Many incidents documented in SolidityScan, BlockSec, or SlowMist are not present in DeFiHackLabs (e.g., Cetus $260M, UPCX $70M, Stream Finance $93M), indicating complementary coverage across databases.

Major Hacks (2025)¶

Calculated Totals by Category¶

Ranking Justification¶

The OWASP Top 10 2026 ranking is primarily driven by practitioner survey mean rank, with 2025 incident data serving as validation:

• SC01 (Access Control) — Ranked #1 by survey; #2 in total loss ($220M), #2 in frequency (30 incidents) → Strong alignment
• SC02 (Business Logic) — Ranked #2 by survey; #3 in total loss ($188.7M), #1 in frequency (58 incidents, 47.5%) → Strong alignment
• SC09 (Integer Overflow) — Ranked #9 by survey; #1 in total loss ($260.4M) but only 3 incidents → Ranking reflects low frequency despite high impact

Key insight: Survey prioritizes frequency and pervasiveness (SC01, SC02) over single-incident outliers (SC09, SC07). This aligns with practitioner focus on preventing common vulnerabilities rather than rare but catastrophic events.

Calculation Methodology¶

1. Data Collection: Incidents extracted from SolidityScan, BlockSec, and SlowMist Datasets. DeFiHackLabs used for reference and validation (not included in totals).
2. Deduplication: Protocols appearing in multiple sources use the maximum reported amount; category preference: BlockSec > SlowMist > SolidityScan when amounts equal.
3. Filtering: Excludes phishing, CEX infrastructure breaches, rugpulls, and private-key-compromise incidents (non–smart-contract vectors).
4. Mapping: Attack types mapped to OWASP categories using source-specific root-cause labels (e.g., "Access Control Issue" → SC01, "Precision Loss" → SC07, "Contract Vulnerability" → SC02).
5. Aggregation: Totals calculated per category; incident counts reflect unique protocols.

DeFiHackLabs Analysis: DeFiHackLabs provides 88+ 2025 incidents with Foundry PoCs. Key incidents include HegicOptions ($104M, SC02), MIM_Spell/Abracadabra ($1.7M–$13.4M, SC02), Cork Protocol ($12M, SC01), Resupply ($9.5M, SC07), and others. These are cross-referenced with other sources for validation. DeFiHackLabs focuses on reproducible PoCs rather than comprehensive incident coverage, which is why SolidityScan, BlockSec, and SlowMist are used for the primary calculated totals.

Risk Metrics and Formulae¶

The following metrics are calculated for each OWASP category to inform ranking decisions.

Metric Definitions¶

Examples (2025 data):

• SC01 (Access Control): TVL_01 ≈ $220.0M, n_01 = 30.
• SC02 (Business Logic): n_02 = 58, so F_02 ≈ 58 / 122 ≈ 47.5% (highest frequency / likelihood).
• SC09 (Integer Overflow): TVL_09 ≈ $260.4M, n_09 = 3, so Ā_09 ≈ $86.8M per incident (high impact, low frequency).

Visual Relationship of Metrics (Conceptual)¶

flowchart LR
    A["Incidents per Category"] --> B["Total Incidents<br/>(N_total)"]
    A --> C["Total Value Lost<br/>(TVL_j)"]
    A --> D["Frequency<br/>(F_j)"]
    B --> D
    A --> E["Likelihood<br/>(L_j)"]
    A --> F["Average Loss<br/>(Ā_j)"]
    G["Survey Responses"] --> H["Ease of Exploitation<br/>(E_j)"]
    D --> I["Composite Risk Score<br/>(R_j)"]
    C --> I
    H --> I

The OWASP Smart Contract Top 10 2026 ultimately prioritises survey mean rank as the primary ordering signal, with these quantitative metrics used to validate and explain the final ranking.

Attribution¶

The survey and data collection for the 2026 ranking were coordinated by CredShields in collaboration with the OWASP Smart Contract Top 10 project. Data sources are attributed where applicable; methodology and statistics are documented in Methodology.