Curve Pools Drained After Vyper Reentrancy Locks Failed

Multiple liquidity pools operating through Curve Finance were exploited on July 30, 2023 after a defect in certain versions of the Vyper smart-contract compiler caused reentrancy protections to malfunction.

Curve’s event-day notice initially identified the alETH/ETH, msETH/ETH and pETH/ETH pools using Vyper 0.2.15. Vyper’s maintainers simultaneously warned that versions 0.2.15, 0.2.16 and 0.3.0 were vulnerable and urged projects relying on those releases to contact the development team. The CRV/ETH pool was also drained later on July 30.

The attacks mattered beyond the assets removed from individual pools. Curve was important infrastructure for exchanging similarly priced assets, while its CRV/ETH pool supplied a major venue for on-chain liquidity in Curve’s governance token. The incident therefore disrupted both protocol users and the market structure supporting CRV-backed positions elsewhere in decentralized finance.

A protection existed in source code but failed in execution

Reentrancy occurs when a contract makes an external call and control returns to another function before the original operation has completed its state updates. An attacker can exploit that sequence to make the contract calculate balances using an inconsistent intermediate state.

The affected Curve pool code declared non-reentrancy protection. The problem identified on July 30 was lower in the software stack: susceptible Vyper compiler versions assigned named locks incorrectly. Functions intended to share one lock could instead receive different storage locations, permitting cross-function reentry under particular contract conditions.

That distinction limited the scope of the warning. The disclosure did not establish that every Vyper contract, every Curve deployment or every pool using those compiler releases could be drained. Exploitability also depended on contract structure, including an external interaction occurring before relevant state updates and a second function that could act on the unfinished state.

Curve said unaffected pools remained safe in its initial notice. That was a contemporaneous protocol assessment during an active incident, not an independent guarantee covering every deployment. The breadth of exposure was still being investigated on July 30.

Separate pools, protocols and actors

The affected pools connected Curve infrastructure with assets associated with JPEG’d, Alchemix and Metronome, as well as Curve’s own CRV token. Contemporaneous reporting and later transaction analysis indicate that several actors executed or intercepted exploit transactions. Some funds were removed by apparent attackers, while an address associated with the name c0ffeebabe.eth used similar techniques and returned assets attributed to rescue transactions.

That mixed activity makes “stolen,” “drained,” “affected” and “lost” materially different measurements. A gross pool outflow does not necessarily equal an attacker’s final proceeds, a protocol’s permanent shortfall or a liquidity provider’s ultimate loss. On July 30, recovery efforts and attribution were incomplete, so a definitive net-loss figure was not yet available.

The incident also demonstrated a software-supply-chain risk specific to programmable finance. Independently operated protocols had inherited exposure from a shared compiler. Audits of application source code could miss a defect introduced when that source was converted into executable bytecode, particularly when the declared security control appeared correct at the language level.

What the record established on July 30

By the end of July 30, Curve and Vyper had publicly connected the attacks to malfunctioning reentrancy locks, several ETH-paired pools had been compromised, and responders were tracing transactions and attempting recoveries. No final accounting, reimbursement plan or formal vulnerability advisory had yet been completed.

Later clarification

Vyper’s August 5 security advisory formally classified the defect as critical, confirmed versions 0.2.15, 0.2.16 and 0.3.0 as affected, and identified 0.3.1 as patched. Chainalysis estimated approximately $70 million in gross losses on August 2 while warning that recoveries could reduce the ultimate loss. Those later records clarify the incident’s scale and mechanics; they are not presented as finalized knowledge available during July 30.