What happened
On July 11, 2023, Libertify, a DeFi portfolio-management application deployed on Ethereum and Polygon, was exploited through a reentrancy flaw in its LibertiVault deposit path. Security analyses reported approximately $452,000 extracted across the two chains. Libertify stated that only $232 of the total was user funds, with the remainder attributed to internal or company funds; the page therefore distinguishes the transaction-level extraction from confirmed user loss.
LibertiVault’s deposit path lacked reentrancy protection around external interaction and share-accounting updates. Vaults should follow checks-effects-interactions, update accounting before callbacks, use a reentrancy guard at every external entry point that reaches the same state, and test cross-function re-entry such as a deposit path re-entering through userSwap.
Case & protocol details
Attack Timeline
The vulnerable LibertiVault deposit flow made an external call before its share-accounting state was fully protected. The attacker re-entered the deposit/userSwap path during that callback, manipulating the deposit flow so that total supply and share minting no longer reflected the assets actually contributed. The attacker could mint additional shares and redeem or move value from the vault.
The same attacker identity was observed on Ethereum and Polygon; security reporting describes the Polygon proceeds being bridged to Ethereum. The exploit was possible because the state transition that established the deposit’s accounting effect was not made safe against a nested call.
Evidence & learning
Attack pattern
Compare incidents →Sources and on-chain records
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.