Conic Finance exploited twice on July 21, 2023 for ~$4.2M ($3.3M ETH Omnipool, $934K crvUSD Omnipool) via read-only reentrancy in CurveLPOracleV2. Price manipulation extracted value from asset pools; audit findings hadn't covered this contract.

On July 21, Conic Finance ’s ETH omnipool was hit by a series of small hacks that cost around $3.2 million. Conic Finance issued an update on the attack, saying, “The root cause of the attack is due to an incorrect assumption about the address returned by the ETH’s Curve meta-registry in the Curve V2 pool, which enables reentrancy attacks and is deploying fixes for the affected contracts.