What happened
On March 31, 2022, a reentrancy vulnerability in the ERC677 token-transfer path of Voltage Finance's Ola-powered Fuse lending deployment was exploited for more than $4.67 million. The attack was limited to the Fuse deployment and the teams said they were working on user compensation.
How it happened
- The attacker interacted with a lending market that handled ERC677 token transfers.
- A callback during the transfer path enabled reentrant calls before the lending operation's accounting was safely finalized.
- The attacker repeated the path to extract assets from the Fuse lending deployment.
- Ola and Voltage paused the affected Fuse lending service while investigating and preparing compensation measures.
Protocol details
Classification
Smart Contract Language / Borrowing and Lending / Reentrancy
Protocol Type
Exploit/Other
Implementation language
Solidity
Protocol links
Website
@ola_finance
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
