An attacker exploited read-only reentrancy in dForce's Curve vault integration on Arbitrum and Optimism. During asset withdrawal, the attacker called back into the protocol to manipulate Curve's virtual price and liquidate wstETH/ETH positions.