Decentralized finance (DeFi) protocol Conic Finance said Friday that it had suffered an exploit that allowed an attacker to grab over 1,700 ether (ETH), worth over $3.6 million at current prices, that affected one of its Omnipools.

Security firm BlockSec said that the root cause of the attack was price manipulation caused by "read-only reentrancy." Reentrancy is a common bug that allows attackers to trick a smart contract by making repeated calls to a protocol in order to steal assets. A call is an authorization for the smart contract address to interact with a user’s wallet address.

We are currently investigating an exploit involving the ETH Omnipool and will share updates as soon as they are available.
— Conic Finance (@ConicFinance) July 21, 2023

Conic Finance, which went live on March 1, allows users to deposit tokens into its Omnipools, a new product that diversifies exposure across the Curve ecosystem while increasing rewards. The protocol attracted millions of dollars in capital shortly after going live, suggesting huge demand for such a product.

Each Omnipool allocates liquidity of a single asset into different Curve pools. All Curve liquidity provider (LP) tokens get staked on Convex to boost Curve (CRV) rewards earnings. Convex (CNX), another Curve ecosystem token, is also rewarded, as is Conic (CNC), Conic’s native token.

Meanwhile, Conic Finance developers tweeted that they were continuing to investigate the root cause of the exploit and were consulting with relevant parties.

The developers added that they had closed the faulty pool that apparently allowed the hack to take place. "We have disabled ETH Omnipool deposits on the Conic front end," they wrote.

DeFi Hack

Shaurya Malwa

Shaurya is the Co-Leader of the CoinDesk tokens and data team in Asia with a focus on crypto derivatives, DeFi, market microstructure, and protocol analysis. Shaurya holds over $1,000 in BTC, ETH, SOL, AVAX, SUSHI, CRV, NEAR, YFI, YFII, SHIB, DOGE, USDT, USDC, BNB, MANA, MLN, LINK, XMR, ALGO, VET, CAKE, AAVE, COMP, ROOK, TRX, SNX, RUNE, FTM, ZIL, KSM, ENJ, CKB, JOE, GHST, PERP, BTRFLY, OHM, BANANA, ROME, BURGER, SPIRIT, and ORCA. He provides over $1,000 to liquidity pools on Compound, Curve, SushiSwap, PancakeSwap, BurgerSwap, Orca, AnySwap, SpiritSwap, Rook Protocol, Yearn Finance, Synthetix, Harvest, Redacted Cartel, OlympusDAO, Rome, Trader Joe, and SUN.