Conic Finance Hack

Reported loss $3.3M
Ethereum
Curve LP valuation manipulation using flash liquidity

What happened

On July 21, 2023, an attacker drained about 1,724 ETH, roughly $3.2 million, from Conic Finance's Ethereum ETH Omnipool. The attack combined temporary flash liquidity with a read-only reentrancy flaw in the protocol's Curve LP valuation path. This page covers the ETH Omnipool exploit, not Conic's separate crvUSD event.

Technical root cause

Conic's Curve LP valuation path was exposed to read-only reentrancy during a native-ETH withdrawal callback. The reentrancy guard bypassed the affected Curve v2 pool because its ETH-pool check expected the native-ETH sentinel while the registry returned WETH.

How it happened

During a Curve withdrawal that paid native ETH, the attacker re-entered Conic while Curve's LP accounting was temporarily inconsistent. Conic's guard failed to recognize the affected pool because it expected the native ETH sentinel while Curve reported WETH. The attacker used the distorted LP price to mint and withdraw more omnipool value than their position justified, repaid the flash loans, and retained the remainder.

Protocol details

Classification Read-only reentrancy
Protocol Type Yield
Implementation language Solidity
Protocol links Website @ConicFinance
Attacker Address 0x8D67db0b205E32A5Dd96145F022Fa18Aae7DC8Aa
Exploit Transaction 0x8b74995d1d61d3d754…4ec7bbe146

Security review history

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Flash Loan Attacks Reentrancy

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes