A hacker siphoned more than $3.6 million from the decentralized finance (DeFi) protocol dForce in what appears to be a reentrancy attack on a Curve vault it operated on the Arbitrum and Optimism blockchains.
The DeFi project confirmed the incident in a Twitter post, adding that it has paused its contracts to prevent further damage.
The attack was seemingly enabled by a reentrancy vulnerability, which can occur when an attacker repeatedly invokes a smart contract function and extracts assets from it before the contract updates its internal state. This can happen when there is a bug in the smart contract code or a lack of proper security measures.
"On Feb. 10, our wstETH/ETH Curve vaults on Arbitrum and Optimism were exploited and we immediately paused all vaults. The vulnerability is identified, and the exploit was specific to dForce's wstETH/ETH-Curve vault," the team noted.
All Comments