What happened
On January 28, 2024, an attacker drained Barley Finance's Wrapped Barley (wBARL) pod on Ethereum, taking about $130,000 in assets. The wBARL contract let anyone flash-borrow its BARL and also let anyone bond BARL into it to mint wBARL, but it had no reentrancy protection linking the two. The attacker borrowed the pod's BARL, bonded that same BARL back in during the flash-loan callback, and the repayment check passed because the pod's balance had been restored. The attacker kept the newly minted wBARL, debonded it for BARL, sold the BARL for DAI and repeated the cycle. More than 10% of the BARL in the pod was taken.
Barley Finance said about 9% of the pod's BARL came from the team's marketing and development allocations, so user losses were limited. It said it would change the wBARL contract to remove the vulnerable function and invited affected users to apply for compensation by email. Neptune Mutual later noted that the front end and social accounts had gone offline, that the contract had been deployed only two days earlier, and that the pool appeared to be funded mainly by the team. On that basis it suggested an insider or rug pull was possible. That remains speculation.
How it happened
- The attacker (
0x7b3a6eff1c9925e509c2b01a389238c1fcc462b6) calledflash()on the wBARL contract through an attack contract (0x356e7481b957be0165d6751a49b4b7194aef18d5), borrowing the pod's entire BARL balance. - Inside the flash-loan callback, the attack contract called
bond()with the borrowed BARL. The pod pulled the BARL back in and minted wBARL to the attacker. - When the callback returned,
flash()only checked that the pod's BARL balance was back to its starting level. The bonded BARL satisfied that check, so the loan counted as repaid and the attacker kept the wBARL for free. - The attacker called
debond()on the wBARL to withdraw BARL from the pod and sold it into the BARL/DAI pool for DAI. - Repeating the cycle removed more than 10% of the pod's BARL, about $130,000 in total (example transaction
0x995e880635f4a7462a420a58527023f946710167ea4c6c093d7d193062a33b01).
Protocol details
Evidence
- transaction Etherscan transaction 0x995e8806...2a33b01 etherscan.io
- code DeFiHackLabs 2024 incidents: 20240128 BarleyFinance - Reentrancy github.com
- analysis DeFiLlama defillama.com
- analysis Analysis of the Barley Finance Exploit (Neptune Mutual, Wayback copy) web.archive.org
- analysis Barley Finance: The wBARL pod contract was attacked and more than 10% of BARL was stolen bitget.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
