Leaderboard
381All-time rank
dForce Lending
Feb 10, 2023
$3.6M
Lost
$3.6M
Recovered
$0
Net loss
$3.6M
Unrecovered0% recovered
An attacker exploited read-only reentrancy in dForce's Curve vault integration on Arbitrum and Optimism. During asset withdrawal, the attacker called back into the protocol to manipulate Curve's virtual price and liquidate wstETH/ETH positions.
How the exploit worked
View reproducible PoCRead-Only-Reentrancy.
Lost: ~$3.65M
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Reentrancy
- Technique
- Read-Only Reentrancy
- Attribution
- Unknown
- Chains
ArbitrumOptimism
Event timeline
- Feb 10, 2023Exploit executed — $3.6M drained via read-only reentrancy
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)