Curve Reentrancy Exploit

Currently, there is insufficient liquidity to liquidate Michael’s loan. In fact, a $1M market sell would result in 85.48% slippage, while a $100M market sell would result in 99.18%. Given that the CRV collateral will not be offloaded at current prices if Michael’s loans get liquidated, this represents a systematic risk to lending protocols. In the worst case scenario, these protocols could take on a significant amount (8 digits) of bad debt, with cascading effects across the DeFi ecosystem, including but not limited to, lending protocols running their insurance fund dry and minting tokens to repay lenders, and any protocol depending on Curve/Curve emissions for liquidity will be dead. Our initial thoughts are that it is purely on the lending protocol for allowing Michael to take out such a large loan against such illiquid collateral onchain. In addition, this exploit shows that DeFi is still widely inter-connected and hacks often pose systematic risks in surprising ways. 

It is shocking that such a systematic technical risk has been present across DeFi, since July 22, 2021 to be exact. As a result of decreased LP confidence, Curve’s TVL has nearly halved in the span of days. This also makes one wonder, what other DeFi “blue chips” are currently exploitable, and if they are truly safe.