On November 10, 2022, DFX Finance V2 was exploited for $4.3 million (plus $3.2M via MEV) through a reentrancy vulnerability in the flash function introduced in V2. The contract failed to prevent reentrant deposits, allowing attacker to repay flashloans while recording deposits as debt.