On July 30, 2026, Set Protocol was exploited for ~$9.6K via reentrancy in Index Coop's ExchangeIssuance contract. Attacker supplied malicious manager pre-issue hook that inflated positionMultiplier mid-issuance. Unlocked state allowed the hook to mutate position accounting, causing overpayment of assets.

The DeFi protocol Set Protocol (involving Index Coop’s ExchangeIssuance contract) was exploited due to insufficient state locking in the smart contract. The attacker used a malicious manager pre-issue hook to artificially inflate asset valuations (e.g., positionMultiplier), causing the contract to transfer excess assets based on falsified data, resulting in a loss of approximately $9,600.