Curve Finance swimming pools exploited in over $24M as a result of reentrancy vulnerability

A number of secure swimming pools on Curve Finance utilizing Vyper have been exploited on July 30, with losses reaching $24 million on the time of writing. In keeping with Vyper, its 0.2.15, 0.2.16 and 0.3.0 variations are weak to malfunctioning reentrancy locks. 

“The investigation is ongoing however any mission counting on these variations ought to instantly attain out to us,” Vyper wrote on X.

We’re working a big white hat rescue operation. Please attain out should you suppose you are affected as a mission. https://t.co/tssWcRHg35

— sudo rm -rf –no-preserve-root / (@pcaversaccio) July 30, 2023

In keeping with preliminary investigation, some variations of the Vyper compiler don’t appropriately implement the reentrancy guard, which prevents a number of features from being executed on the similar time by locking a contract. Reentrancy assaults can doubtlessly drain all funds from a contract.

Plenty of decentralized finance initiatives have been affected by the assault. Decentralized alternate Ellipsis reported {that a} small variety of secure swimming pools with BNB have been exploited utilizing an outdated Vyper compiler. Alchemix’s alETH-ETH additionally witnessed $13.6 million outflow, together with $11.4 million exploited on JPEGd’s pETH-ETH pool, and $1.6 million in Metronome’s sETH-ETH pool.

Sure sort of Curve manufacturing facility pool is encountering read-only reentrancy assault and inflicting a complete lack of $11m(@JPEGd_69) + $13m(@AlchemixFi) + …

Preliminary investigation founds that vyper compiler (0.2.15) does not implement the reentrancy guard appropriately.

add_liquidity and… pic.twitter.com/avaHdtSFsm

— Tony KΞ (@tonyke_bot) July 30, 2023

The exploit sparked panic throughout the DeFi ecosystem, prompting a wave of transactions throughout swimming pools and a rescue operation from white hats. Knowledge from CoinMarketCap reveals Curve Finance’s utility token Curve DAO (CRV) declining over 5% in response to the information. CRV’s liquidity has declined considerably in latest months, making it weak to violent value swings, Cointelegraph reported. In keeping with Curve Finance, crvUSD contracts and any swimming pools with it weren’t affected by the assault.

Curve Finance is a DeFi protocol that permits the decentralized alternate (DEX) of stablecoins inside Ethereum.

It is a growing story, and additional info will likely be added because it turns into accessible.