On July 30, 2023, several liquidity pools on Curve Finance were exploited, resulting in approximately $70 million in losses and triggering panic within the DeFi ecosystem, the team at Chainalysis noted.
In a blog post, Chainalysis also mentioned that these hacks occurred due to “a vulnerability in Vyper, a third-party Pythonic programming language for Ethereum smart contracts used by Curve and other decentralized protocols.”
Since then, several white hat hackers and MEV bot operators “have helped recover some of the funds, which means the actual value lost may end up being lower than the total currently reported. Below, we’ll share what we know so far about the hack.”
Vyper’s similarity to Python has “made it an attractive entry point for developers into the DeFi ecosystem.” According to Vyper, “its 0.2.15, 0.2.16, and 0.3.0 versions contained issues making some smart contracts vulnerable to re-entrancy attacks, in which attackers can trick the contracts into incorrectly calculating balances, allowing them to steal funds held by the contracts’ protocols.”
The massive hack began “with an exploit of NFT lending protocol JPEG’d’s pETH-ETH pool for $12 million.” However, that attacker appears “to have been front-run by an MEV bot, which identified the attacker’s desired exploit and executed a similar transaction before the original occurred, in what may have been a white hat hacking effort.”
Soon after, a series of separate attacks “hit other pools, including Alchemix DAO’s alETH-ETH for $20 million ($17 million in ETH and $3 million in ERC-20s), Metronome DAO’s sETH-ETH for $1.6 million, and Curve’s CRV/ETH pool for $18 million.” Curve’s CEO, Michael Egorov, then confirmed “on Telegram that $22 million worth of CRV tokens was drained from Curve’s swap pool.”
MEV bots have been heavily “involved in front-running attempted hacks on Curve, resulting in the largest MEV block rewards in Ethereum’s history.”
In some cases, MEV bot operators “have acted as white hats and returned funds taken from Curve in front-runs of malicious transactions, but the extent of this activity isn’t yet known.”
One MEV bot operator “in particular, c0ffeebabe.eth, has been prolific in front-running exploits.”
This white hat hacker “front-ran exploiters and returned funds in past incidents such as the April 2023 bug in the SushiSwap router contract.” In the case of Curve, c0ffeebabe.eth successfully “exploited around $5.3 million from its CRV/ETH pool and around $1.6 million from its Metronome msETH pool, and later returned the funds to both affected protocols.”
Chainalysis has shared some of these movements on the Chainalysis Reactor graph.
After news broke of the hacks, CRV declined 5%. This decline, “along with the risk that malicious hackers in possession of millions’ worth of CRV could sell into the token’s now-illiquid market, triggered fears of contagion effects for some DeFi protocols.”
In particular, the lending protocol AAVE “appears to be at risk of incurring debt due to Egorov’s massive and well-known borrow position secured by CRV token collateral.”
At this time, Curve has “not detailed any recovery plans, but publicly advised its users to withdraw funds from Vyper-based pools.”
Chainalysis have labeled “all addresses relevant to the Curve hacks in Chainalysis products and will continue to provide updates on the situation when possible.”
