On March 27, 2022, Revest Finance was exploited via ERC1155 reentrancy when the fnftId counter was incremented after the external callback. The attacker re-entered the mint function to create multiple FNFTs pointing to the same pool, then redeemed all to drain ~$2M in BLOCKS, ECO, and RENA tokens.

DeFi protocol Revest Finance has been hacked. Hackers stole nearly 7.7 million ECO, 579 LYXe, nearly 715 million BLOCKS, and over 350,000 RENA. According to SlowMist analysis, this attack is because the handleMultipleDeposits function in the tokenVault contract does not determine whether the newly minted NFT exists, so the attacker uses this point to directly modify the information of the NFT that has been minted, and in the Revest contract The key functions in this are not restricted by reentrant locks, which lead to being used by callbacks.