Computer security experts have discovered a vulnerability in Vyper versions 0.2.15, 0.2.16 and 0.3.0. It’s about a faulty re-entry interlock. As noted by Curve Finance developers, hackers compromised at least four liquidity pools and withdrew all funds from aETH/ETH, msETH/ETH, pETH/ETH and CRV/ETH. The losses totaled more than $22 million.
As BlockSec reported, all pools involving “wrapped ETH” – WETH – were potentially at risk. The fact is that the Vyper smart contract programming language was created specifically for the Etherium Virtual Machine (EVM) and is used quite extensively.
In addition to the attacks on Curve Finance, there was also a $13.6 million outflow from the alETH-ETH pool of the Alchemix project. $11.4 million was withdrawn from the pETH-ETH pool of the PEGd project. $1.6 million was withdrawn from the Metronome project. Hacks via a vulnerability in the Vyper language have also been reported in projects based on the BNB Smart Chain.
Some “white-hat hackers” have already started refund efforts. For example, a specialist under the pseudonym “c0ffebabe.eth” managed to return $5 million to Curve Finance wallets. It was recently reported that hackers broke into the Alphapo platform and withdrew $31 million worth of cryptocurrencies.