Curve Finance Opens $1.85m Bounty To Identify Threat Actor

Decentralized finance (DeFi) protocol Curve is offering a $1.85 million reward to anyone who can identify the exploiter responsible for draining over $61 million from its pools on July 30. This announcement was made after the deadline for the voluntary return of funds expired.

The exploiter used vulnerable versions of the Vyper programming language to launch reentrancy attacks on targeted stable pools, leading to significant losses. Following the attack, Curve and other affected protocols offered a 10% bug bounty to the exploiter, totaling more than $6 million.

In response, the hacker returned stolen assets to two projects, Alchemix and JPEGd, but did not refund other affected pools.

What is a reentrancy attack?

A reentrancy attack, the method used by the exploiter in this case, is a common security vulnerability in smart contracts, especially those running on blockchain platforms like Ethereum. In a nutshell, a reentrancy attack allows an attacker to repeatedly call a functiorn in a smart contract while a previous call to that same function has not yet finished executing.

The Vyper programming language, which was used to build the targeted stable pools in this case, is a contract-oriented language similar to Solidity, another popular language for writing smart contracts on Ethereum. While Vyper is designed with a stronger emphasis on security and simplicity, it is not immune to reentrancy attacks, which are a pervasive problem in the world of smart contracts.

During a reentrancy attack, an exploiter can drain funds from a contract by recursively calling a function that withdraws funds. In this case, the exploiter managed to drain more than $61 million from several of Curve's stable pools, illustrating the severity of the attack and the poterntial impact of these types of vulnerabilities in the DeFi space.

The incident underscores the importance of proper security practices and rigorous code review in the development of smart contracts. Despite the relative maturity of DeFi, the risk of smart contract vulnerabilities like reentrancy attacks remains, necessitating ongoing vigilance and robust security measures from DeFi projects.

What's at stake for Curve Finance?

Curve has now extended its bounty to the public, promising a reward equivalent to 10% of the remaining exploited funds (currently $1.85 million) to anyone who can identify the exploiter in a way that results in legal conviction. However, the firm has stated that it will not pursue the issue further if the exploiter chooses to return the stolen funds in full.

Prior to returning some of the funds, the exploiter had sent a message to the Alchemix and Curve teams, stating that they were refunding the money not because the teams could find them, but because they didn't want to ruin the projects.

The July 30 attack targeted several of Curve’s pools, including those of Alchemix, JPEGd, and Metronome, resulting in significant losses. The exploit exposed vulnerabilities across DeFi projects and triggered industry-wide efforts to recover stolen funds.

Disclaimer: This article is provided for informational purposes only. It is not offered or intended to be used as legal, tax, investment, financial, or other advice.