What happened
Agave lost about $5.5 million in the March 15, 2022 Gnosis Chain attack. Its developers' postmortem identifies reentrancy during liquidation: a bridged WETH callback let the attacker change collateral before a stale check disabled it. The simultaneous Hundred Finance loss was separate.
Technical root cause
A token-transfer callback changed collateral before liquidation applied a stale collateral-usage check.
How it happened
- Liquidation cached the borrower's starting collateral balance.
- Burning the collateral receipt token transferred bridged WETH, which called back into attacker code.
- During the callback, the attacker deposited more collateral and borrowed against it.
- The resumed liquidation used the old balance to disable that collateral. The attacker could then withdraw it while leaving loans unpaid.
Protocol details
Classification
Ecosystem / Borrowing and Lending / Reentrancy
Protocol Type
Lending
Affected asset / contract
AGVE
Implementation language
Solidity
Protocol links
Website
@Agave_lending
Evidence
Proof of concept
1 availableSources
- report Agave exploit - Reentrancy in Liquidation Call medium.com
- report Post-mortem rekt.news
- report @Agave_lending incident report twitter.com
- report Agave DAO, Hundred Finance - REKT rekt.news
- transaction Transaction gnosisscan.io
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
