A NullMeridian record Andromeda Logs

NullMeridianLog

30 Jul 2023

Curve: Vyper 0.2.15 Reentrancy Lock Failure Hit Several Pools

Curve: on 30 Jul 2023 several pools compiled with Vyper 0.2.15 were exploited after a malfunctioning reentrancy lock. Curve said other pools were safe.

  • Event date
  • Incident typeCompiler / smart-contract exploit
  • Bug classReentrancy
  • Published

Loss, as sourced

Press put gross over $70M with whitehat activity nearer ~$50M net. Curve confirmed Vyper 0.2.15 reentrancy-lock malfunction on specific pools.

Traceability

Primary sources

  1. 01x.comCurve Finance confirmation, 30 Jul 2023 (opens in a new tab)

In brief

Root cause: Per Curve: Vyper 0.2.15 reentrancy lock malfunction on listed stablepools; other pools safe.

Timeline, as sourced: 30 Jul 2023.

Account, as sourced

Claimed (Curve Finance): Vyper 0.2.15 reentrancy lock failure on affected pools.

Summaries of public sources as of the published date; except where marked (on-chain), not independently verified by NullMeridian. Figures are the sources’ own and are attributed; where sources disagree, each is given. Sources may since have changed. Not legal, financial or investment advice.

Permalinkhttps://andromeda.observer/e/curve-vyper-reentrancy-2023