GlossaryIntermediate
Zero-Day Exploit
An attack that exploits a previously unknown vulnerability, used before the vulnerability has been publicly disclosed or patched.
A zero-day exploit takes advantage of a previously unknown, undisclosed vulnerability — named for the fact that developers have had zero days to address it, since the vulnerability wasn't known to exist until the exploit itself revealed it.
In the smart contract context, a zero-day exploit is particularly consequential, since a vulnerable contract's code is typically public and immutable once deployed (see Kaavon's "Smart Contract" glossary definition) — unlike traditional software, there's often no way to silently patch the vulnerability before funds can be drained.
Examples
- A zero-day exploit against a smart contract can be especially damaging, since the contract's immutable code often can't be silently patched before funds are drained.
- A zero-day exploit is, by definition, one neither the development team nor any external auditor had previously identified or disclosed.