blockworks.co
Over $70 million in various digital assets have been hacked in a series of attacks on the Curve Finance decentralized exchange on Sunday.
The attacks began at roughly 9:30 am ET, beginning with an exploit of JPEG’d’s pETH-ETH liquidity pool for over $11 million, although that may have been frontrun by an MEV searcher.
Four other attacks — potentially all launched by different actors — also drained Alchemix’s alETH-ETH pool, the CRV/ETH pool twice, Pendle’s pETH-ETH pool, and Metronome’s msETH-ETH pool, for a total of over $70 million, per security expert analysis. Some of the hacks were reportedly executed by whitehat hackers, meaning that the total amount lost could be closer to $50 million.
In a statement on the Curve Discord, team representative “mimaklas” wrote at roughly 4:30 pm ET that “all affected pools have been drained or white hacked. All remaining pools are safe and unaffected by the bug.” A Curve representative declined to comment.
Despite these public statements, the attacks may still be ongoing. Two hours after mimaklas’ message, another exploit of the CRV-ETH pool drained an additional $5.2 million.
With $3 billion in liquidity, Curve is comfortably the second-largest and most structurally significant DEX in DeFi, and carries particular importance for stablecoin swap markets — which were not impacted. Curve’s CRV governance and rewards token is down 13.4% to $0.64 after falling as low as $0.58 earlier in the day.
0-day bug
According to Dr. Laurence Day, the founder of Wildcat Finance and a frequent presenter on smart contract exploits, the thefts were enabled by a zero-day vulnerability in particular versions of the compiler for Vyper, the programming language Curve used for multiple contracts.
The vulnerability is rooted in an assumption regarding “reentrancy” preventions that failed to work as intended. Reentrancy attacks are a common exploit vector.
In the hours since the vulnerability came to light, there has been some amount of finger-pointing between development teams. In a since-deleted tweet, the official Curve Twitter account seemed to blame JPEG’d developers for the exploit. JPEG’d’s team in turn defended themselves.
Curve is also an important supporter of the Vyper team, having funded its ongoing development in the past, and Curve team members are actively involved in the maintenance of the Vyper codebase.
Day cautioned against blaming any one team for the exploit.
“Compilers come pre-packed with a whole host of behavioural assumptions that the vast majority of us simply take for granted because we assume that people smarter than us have done the leg-work closer to assembly,” he wrote. “It’s very easy to point fingers and call out failures to verify these things.”
Alchemix halts contracts
Among the hardest-hit protocols in the attack, Alchemix has paused a number of contracts to prevent the exploiter from swapping alETH for native ETH, including a bridge to Optimism where the AMM Velodrome has $4.4 million in liquidity in an alETH pool, and the “transmuter” contract, which exchanges alETH for ETH 1-to-1.
Alchemix is designed to give users an advance on their future yield, and uses a synthetic ether derivative, alETH, backed by ether in the process.
Nonetheless, in a tweet the Alchemix development team reports that an exploiter managed to take 5,000 ETH from the alETH-ETH pool, possibly leaving the alETH asset partially unbacked. The extent of the damage is unclear; two attacks on the alETH drained over $30 million, but one may have been a whitehat operation.
Additionally, one user who appears to be unassociated with the initial exploits took advantage of the exploit to swap 5 ETH for 1200 alETH, which they subsequently transferred to a secondary address prior to selling.
alETH is currently trading for $1,476 relative to native ETH at $1,887, meaning the market is assuming a 22% lack of backing. alETH has $68 million in total market capitalization per Coingecko, with $38 million on Ethereum mainnet alone.
Alchemix’s governance token ALCX fell about 7% after the exploit.
Possible contagion
Aside from the economic damage from the attacks themselves — the pools that were exploited were significantly larger in dollar terms at the time of attack than what the exploiters actually managed to swipe — many observers are worrying over the potential ripple effects.
Of particular interest is Curve Finance founder Michael Egorov’s $60 million Aave V2 loan. The loan is backed primarily with CRV tokens far in excess of what the protocol could easily liquidate, which could potentially result in bad debt.
The size of Egorov’s position is such that it has perhaps previously been the target of attack.
After Egorov’s account added collateral to the protocol and paid down nearly $4 million in debt, the position is currently stable.
Potential recovery
A portion of the hacked funds not seized by whitehats have also already proved to be recoverable.
Three of the five exploits were frontrun by MEV searchers, including the attack on the pETH-ETH pool, the msETH-ETH pool, and the second attack on the CRV-ETH pool.
In the case of the latter two, the exploits were frontrun by prolific MEV account coffeebabe.eth. This address previously attempted to communicate with Sushi to return funds after frontrunning another exploit months ago.
Their address remained active throughout the ordeal, executing trades on popular memecoins in addition to frontrunning the attacks, implying that the frontruns might have occurred autonomously by the account without active knowledge on the part of the account owner.
Curve communicated on-chain with Coffeebabe.eth who expressed intent to move exploited funds to cold storage, as well as their wish to return funds to affected parties.
As of roughly 8:00 pm ET coffeebabe.eth returned the funds from the second CRV/ETH pool exploit.