Revest Finance Hack

Reported loss $2.0M
Ethereum
ERC-1155 callback reentrancy

What happened

On March 27, 2022, Revest Finance's Ethereum TokenVault was exploited for roughly $2 million in BLOCKS, ECO, LYXe and RENA. The attacker abused FNFT minting and an ERC-1155 callback to make the protocol reuse an FNFT ID before its counter was updated, then altered that FNFT's recorded deposit amount and redeemed the inflated supply. Revest froze the protocol and said other chains and non-TokenVault integrations were unaffected.

Technical root cause

FNFTHandler updated the fnftsCreated counter after the external ERC-1155 mint callback. Reentrant execution reused an existing FNFT ID, and depositAdditionalToFNFT lacked an existence check before changing the TokenVault configuration. Moving state updates before the external call and rejecting zero/repeated FNFT mints were the documented fixes.

How it happened

  1. The attacker used a custom contract to mint an address-locked FNFT with zero deposited value and then initiated a second mint for a large FNFT supply.
  2. During the second mint, the ERC-1155 onERC1155Received callback re-entered depositAdditionalToFNFT before fnftsCreated was incremented.
  3. getNextId() therefore returned the already-used FNFT ID; because the code did not check for an existing configuration, the callback overwrote its depositAmount with one token.
  4. The attacker withdrew the entire FNFT supply from the TokenVault, draining the targeted asset. Revest paused RVST transfers and soft-locked contracts, preventing further RVST-ETH losses.

Protocol details

Classification Smart Contract Language / Reentrancy / NFT
Protocol Type NFT Lending
Implementation language Solidity
Protocol links Website @RevestFinance

Security review history

Evidence

Proof of concept

1 available

Sources

Understand the attack patterns

Compare incidents →
Reentrancy

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes