On July 21-22, 2023, Conic Finance suffered two exploits via read-only reentrancy in CurveLPOracleV2. Attackers manipulated perceived prices to drain $3.26 million from the ETH omnipool; a second exploit of $300K occurred shortly after.

This second attack was unrelated to the ETH Omnipool's re-entrancy exploit. The attacker was able to realize a profit of approximately $300k by exploiting the crvUSD Omnipool. We will share more updates as we continue to investigate.