Series of Exploits Hit Curve Finance’s Liquidity Pools
Curve Finance faces multiple exploits on its liquidity pools, resulting in significant losses for projects like Conic Finance, JPEGd, Metronome, and Alchemix. Speculated reasons include vulnerabilities in programming language versions and manipulation of the “get_virtual_price” function, highlighting the need for enhanced security measures in the DeFi space. The recent incidents, involving Conic Finance, JPEG‘d, Metronome, and Alchemix, have raised concerns within the DeFi community. The string of attacks began with Conic Finance on July 21, where assets were drained due to a connection with LP Tokens on Curve Finance. Subsequently, on July 30, the Lending NFT JPEG’d project reported an exploit involving the pETH-ETH liquidity pool on Curve Finance, resulting in an $11 million loss. The same day, Metronome also suffered a $1.6 million loss following a similar exploit. Additionally, Alchemixs alETH became a victim, experiencing an estimated $13.6 million loss linked to a liquidity pool on Curve. The exact reasons behind these exploits have not been fully disclosed at this time. However, the community has speculated two primary factors. First, vulnerabilities in versions 0.2.15/0.2.16/0.3.0 of the VyperLang programming language are suspected. These versions lack the Re-Entrancy anti-attack filter, enabling hackers to execute rounding attacks and withdraw funds from liquidity pools. The second conjecture, outlined