Curve Incident Report: Approximately $61.7 Million Loss Across 4 Pools, Next Steps Include Halting G
On August 1st, Curve Finances official account retweeted a post from the crypto risk assessment group LlamaRisk, which detailed a post-mortem analysis of the Curve pool reentrancy exploit. According to LlamaRisks report, a bug in the older version of the Vyper compiler caused a failure in the security feature used by certain limited Curve pools, allowing attackers to deplete the tokens in the affected pools. While Curve is trying to reach out to the exploiters and recover user funds, the exploitation of this vulnerability directly harmed the interests of Curve liquidity providers in the affected pools. Thanks to the efforts of white-hat hackers, the DAO managed to recover some of the tokens from the affected pools. The Curve eDAO is unable to pause the Curve pools or handle user funds in any way, but it can stop the CRV Gauge emissions to the Curve pools. It is expected that the eDAO will eliminate all Gauge emissions to the affected pools. In this incident, the affected pools and the corresponding losses are as follows: pETH/ETH pool: 6,106.65 WETH (approximately $11 million). msETH/ETH pool: 866.55 WETH (approximately $1.6 million) and 959.71 msETH (approximately $1.8 million). alETH/ETH pool: 7,258.70 WETH (approximately $13.6 million) and 4,821.55 alETH (approximately









