What happened
The July 2023 Vyper incident affected pools compiled with versions 0.2.15, 0.2.16, or 0.3.0, where reentrancy locks malfunctioned. CertiK reported $69.3 million taken and $16.7 million returned, with the pETH pool among the affected paths; figures should not be treated as a direct replacement for the supplied historical snapshot without reconciliation.
How it happened
- The attacker targeted a pool compiled with an affected Vyper version.
- The malfunctioning lock failed to prevent a nested call.
- In the illustrated pETH path, the attacker flash-loaned ETH and entered remove_liquidity.
- During the external callback, the attacker called add_liquidity before the original operation completed.
- The altered accounting let the attacker withdraw more value than the pool should have released.
Protocol details
Funds Recovery
Recovered
$6.8M
Net Loss
$43,662,579
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
