Clober Hack

On December 10, 2024, CloberDEX’s Liquidity Vault on the Base network was exploited through a reentrancy vulnerability in the _burn() function, resulting in the theft of approximately 133.7 ETH (~$501,279).

The exploit stemmed from the _burn() function in the Rebalancer contract, where token transfers occurred before critical state variables (pool.reserveA and pool.reserveB) were updated. This deviation from the checks-effects-interactions pattern enabled a reentrancy scenario. The attacker could repeatedly call the function, exploiting the unmodified reserve values to miscalculate withdrawal amounts and drain significant funds.

By timing interactions and re-entering the contract mid-execution, the attacker extracted 133.7 ETH without triggering immediate safeguards. In response, CloberDEX promptly contacted the attacker, requested the stolen funds be returned, and reassured users that the incident did not compromise Clober Core or threaten the integrity of the Mitosis testnet.

Attacker

Address 0x012f…6025

Exploit tx

Tx 0x8fcd…1c04