0day: Vyper nonreentrant lock bypass, enabling cross function reentrancy

On Sunday, 30th July, tragedy struck as a vyper compiler bug was dug up from the past. This document is intended as a technical educational resource to demystify exactly what happened on the compiler side only ahead of the Vyper team’s official post mortem for impatient individuals such as myself. If you’re looking for post mortems of protocols exploited with this vulnerability, Curve released one under Llama Risk. Other affected protocols have yet to release theirs....

August 2, 2023 · 8 min