Conic Finance Hack

REPORTED LOSS $3.3M

Medium Jul 21, 2023 Curve LP valuation manipulation using flash liquidity Ethereum

What happened

On July 21, 2023, an attacker drained about 1,724 ETH, roughly $3.2 million, from Conic Finance's Ethereum ETH Omnipool. The attack combined temporary flash liquidity with a read-only reentrancy flaw in the protocol's Curve LP valuation path. This record covers the ETH Omnipool exploit, not Conic's separate crvUSD event.

Technical Root Cause

Conic's Curve LP valuation path was exposed to read-only reentrancy during a native-ETH withdrawal callback. The reentrancy guard bypassed the affected Curve v2 pool because its ETH-pool check expected the native-ETH sentinel while the registry returned WETH.

Case & protocol details

Classification Read-only reentrancy

Protocol Type Yield

Implementation language Solidity

Official Website conic.finance/

Protocol Twitter/X @ConicFinance

Attacker Address 0x8D67db0b205E32A5Dd96145F022Fa18Aae7DC8Aa

Exploit Transaction 0x8b74995d1d61d3d754…4ec7bbe146

How it happened

During a Curve withdrawal that paid native ETH, the attacker re-entered Conic while Curve's LP accounting was temporarily inconsistent. Conic's guard failed to recognize the affected pool because it expected the native ETH sentinel while Curve reported WETH. The attacker used the distorted LP price to mint and withdraw more omnipool value than their position justified, repaid the flash loans, and retained the remainder.