Recently, the super stablecoin protocol Curve has suffered a reentrancy attack, resulting in severe losses. Below is MetaTrust Labs' security analysis and security recommendations for this attack.
Event Recap
According to Curve Finance's official Twitter, on July 31st, 2023, some stable pools (alETH/msETH/pETH) written in Vyper version 0.2.15 were subjected to a reentrancy attack. Curve Finance stated that this attack was due to a malfunctioning reentrancy lock in Vyper version 0.2.15 and only affected pools using pure ETH. Currently, Curve is assessing the extent of the damage, and other pools are secure.
According to MetaTrust Labs' analysis, this vulnerability was introduced between August and October 2021, mainly caused by the Vyper compilers in versions 0.2.15/0.2.16/0.3.0. The vulnerability was a result of a compiler bug that caused the reentrancy protection in the generated bytecode to not function as intended.
According to on-chain data statistics, the Curve Finance stablecoin pool hack has resulted in a cumulative loss of $52 million for Alchemix, JPEG'd, CRV/ETH pool, etc. Curve Finance's token CRV has also suffered a significant decline, dropping over 15% in a day.
Analysis of Causes
The reason Curve Finance was attacked this time was that Curve used the Vyper language to write smart contracts and used version 0.2.15 of Vyper, which had a vulnerability called malfunctioning reentrancy locks. The attacker exploited this vulnerability to initiate a reentrancy attack and cause losses. This vulnerability in Curve Finance was a Language Specific vulnerability.
Language Specific vulnerabilities refer to vulnerabilities caused by defects or incompatibilities in a programming language or compiler itself. These vulnerabilities are often difficult to detect and prevent because they are not caused by developer negligence or logical errors but by issues with the underlying technical platform. These vulnerabilities can also often affect multiple projects or contracts that use the same language or compiler.
Vyper is a smart contract programming language based on Python, aimed at providing higher security and readability. Vyper claims to be a "security-first" language that does not support certain features that could pose security risks, such as classes, inheritance, modifiers, inline assembly, etc. However, Vyper is not without flaws and still has bugs or vulnerabilities that could affect contract security. For example, apart from the reentrancy lock issue that Curve Finance encountered in this case, Vyper has also had problems with array out-of-bounds, integer overflow, storage access errors, etc.
Security Measures
For the Curve Finance reentrancy attack incident, there are currently some measures that have been taken or proposed. Here are some security measures that can be taken:
Remove Liquidity: For affected pools, users can choose to remove liquidity to avoid further losses. Curve Finance has provided a "Remove Liquidity" button on its website for user convenience.
Upgrade Compiler: For contracts compiled using Vyper 0.2.15/0.2.16/0.3.0 versions, it is recommended to upgrade to the latest Vyper 0.3.1 version, which has fixed the reentrancy lock issue. It is also recommended to use other tools or methods to verify the security of contracts, such as formal verification, code auditing, etc.
Stay Vigilant: For contracts written in Vyper or other languages, it is advised to stay vigilant and keep track of updates and vulnerability fixes in the language or compiler. Take necessary measures to protect your assets. Additionally, it is recommended to carefully assess the maturity and stability of new languages or technologies, and avoid blindly pursuing novelty or efficiency.
Summary
The reentrancy attack incident in Curve Finance is a regrettable security incident and a thought-provoking lesson. In the decentralized finance (DeFi) field, security is always the top priority, and project teams should continuously improve their security awareness and capabilities. Any detail could become a loophole exploited by attackers.
Follow Us
Twitter: @MetaTrustLabs
Website: metatrust.io
