Vyper Hack

Vulnerability in Vyper Compiler exploited, causing a loss of 50,476,970 USD across multiple projects.

The Vyper Compiler, a tool designed for writing smart contracts on EVM-compatible chains, suffered a significant exploit due to a vulnerability in versions 0.2.15 to 0.3.0. Independent security researchers confirmed that the vulnerability was fixed since version 0.3.1. The root cause was separate Reentrancy Lock slots in add_liquidity and remove_liquidity functions in Curve Pools, implemented in the vulnerable Vyper versions, allowing a reentrancy attack.

This exploit affected several projects including MetronomeDAO, JPEG'd, Alchemix, and Curve Pools, resulting in a combined loss of 50,476,970 USD. Some funds were returned, totaling 6,820,757 USD.

Curve Pools:

Exploiters:

https://etherscan.io/address/0xb752def3…41b324

https://etherscan.io/address/0xc0ffeeba…f29671

Malicious Transactions:

https://etherscan.io/tx/0xcd99fadd…ae2052

https://etherscan.io/tx/0x2e7dc8b2…ae477c

Funds Returning Transaction:

https://etherscan.io/tx/0xb7675412…0954fd

JPEG'd:

Exploiter:

https://etherscan.io/address/0x6ec21d18…978538

Malicious Transaction:

https://etherscan.io/tx/0xa84aa065…f1620c

Alchemix:

Exploiter:

https://etherscan.io/address/0xdce5d6b4…75d7d8

Malicious Transaction:

https://etherscan.io/tx/0xb676d789…3c9801

MetronomeDAO:

Exploiter:

https://etherscan.io/address/0xc0ffeeba…f29671

Malicious Transaction:

https://etherscan.io/tx/0xc93eb238…400964

Funds Returning Transaction:

https://etherscan.io/tx/0x650a73bf…469f9a