Breaking: Curve Finance pools exploited over $47M due to reentry vulnerability

Leveraged several stable pools using Vyper on Curve Finance on July 30. Vyper versions 0.2.15, 0.2.16, and 0.3.0 are vulnerable to malfunctioning reentry locks.
Several stable pools using Vyper on Curve Finance were exploited on July 30, with losses exceeding $47 million. According to Vyper, versions 0.2.15, 0.2.16 and 0.3.0 are vulnerable to malfunctioning reentry locks.
"The investigation is ongoing, but any project based on these releases should contact us immediately," Vyper wrote of the X. Vyper 0.2.16 was used and 226 contracts used Vyper 0.3.
According to initial research, some versions of the Vyper compiler do not properly implement reentry protection, which locks out a contract, preventing multiple functions from executing simultaneously. Re-entry attacks can potentially consume all funds in a contract.
Vyper is a contract-oriented, Pythonic programming language targeting the Ethereum Virtual Machine (EVM). The similarities between Python and Vyper make the language one of the starting points for Python developers jumping to Web3.
A number of decentralized finance projects were affected by the attack. Decentralized exchange Ellipsis reported that a small number of stable pools containing BNB were exploited using an old Vyper compiler. Alchemix's alETH-ETH also witnessed $13.6 million outflows, along with $11.4 million in JPEGd's pETH-ETH pool and $1.6 million in Metronome's sETH-ETH pool. Curving Finance CEO Michael Egorov later confirmed that 32 million CRV tokens worth over $22 million had been withdrawn from the swap pool on a Telegram channel.
The exploit caused panic in the DeFi ecosystem, leading to a wave of transactions between pools and a recovery from white hats. Data from CoinMarketCap shows that Curve Finance's utility token Curve DAO (CRV) has dropped over 5% in response to the news. As Cointelegraph reported , CRV's liquidity has decreased significantly in recent months, making it vulnerable to severe price swings. According to Curve Finance, the crvUSD contracts and any associated pools were not affected by the attack.
DeFi protocols have been the target of numerous attacks in the past months. According to a report by Web3 portfolio app De.Fi, more than $204 million was defrauded through DeFi attacks and scams in the second quarter of 2023 alone.
#Bykaranteli# #GateioBountyCreator# #ContentStar# #BountyCreator# #GateioTurns10# #CryptoObserves# #contentcreator# # #NewsMessenger#
#Hot Topic Discussion#
#MyFancyCreator# #美女# #WorldEmojiDay#