Curve Reentrancy Hack 2023 event

Event · PageRank 0.0008

Overview

The Curve reentrancy incident of July 30, 2023 stemmed from a compiler-level bug rather than a flaw in Curve's contract source. Vyper versions 0.2.15, 0.2.16 and 0.3.0 generated code in which the non-reentrant lock used mismatched storage slots, so the guard failed to prevent reentrant calls into affected pools. Attackers used this to drain Curve's CRV/ETH pool and pools operated by JPEG'd, Alchemix and Metronome, for an initial total of about $70 million; recoveries brought the figure down to roughly $52 million. The event prompted broad re-examination of compiler-level trust assumptions in DeFi.

Within the DeFi Intel graph, Curve Reentrancy Hack 2023 connects to 1 tracked entity, most strongly to Curve Finance.

Relations

Top connections in the DeFi Intel knowledge graph (confidence-weighted, 1 of 1 total).

Frequently asked questions

Was the bug in Curve's code?

No. It was in the Vyper compiler: affected versions emitted a faulty non-reentrant lock due to a storage-slot mismatch, so contracts that looked correct in source were exploitable.

Which Vyper versions were affected?

Versions 0.2.15, 0.2.16 and 0.3.0.

Why did the incident matter beyond Curve?

Because it showed that a flaw in shared tooling could simultaneously compromise many independent, audited protocols — Alchemix, JPEG'd and Metronome pools were drained alongside Curve's own.