Correct source, incorrect bytecode
The affected Curve pools declared reentrancy protection. Their source code was right. The compiler emitted bytecode in which the guard did not function as declared, and reentrancy — the oldest well-understood vulnerability class in smart contracts — became exploitable in contracts that had explicitly defended against it.
Why this one is different in kind
Almost every incident in this tracker involves a defect a reviewer could in principle have found by reading the code. This one could not be. A reviewer reading the Vyper source would confirm the lock was present and correctly applied, and would be wrong about the deployed behaviour, through no fault of their own.
That moves the trust boundary. The compiler, and the specific version of it, is part of what has to be trusted. Any project shipping compiled contracts inherits the correctness of its toolchain whether or not anyone has thought about it.
The check worth running
For any Vyper contract you have exposure to, the question is which compiler version produced the deployed bytecode, and whether that version is on the affected list published by the Vyper project. Version metadata is recorded at deployment and is verifiable independently of any claim the project makes.
Timeline
Append-only. Corrections are added as their own dated entry; earlier entries are never rewritten.
- Several Curve pools are exploited via reentrancy. Curve confirms the incident and identifies the Vyper compiler versions involved. Curve Finance
- Curve and Vyper publish the list of affected compiler versions so other projects can check their own deployments. Curve Finance
What to check
The Vyper project and Curve both published which compiler versions were affected. The check that matters for any Vyper contract is which compiler version produced the deployed bytecode.
Conisec does not host or link recovery, revocation or "checker" tools. After a public incident, attackers routinely seed exactly those links using the names of publications covering the story. Use the affected project's own official channel, linked above, and nothing else.
Sources
- Curve Finance, Incident statement and affected Vyper versions (30 Jul 2023)
Not advice. This is a summary of published facts, not legal, tax or security advice. Verify against the primary sources linked above.
Last verified by Conisec Staff.
