On November 12, 2020, Akropolis lost $2 million in DAI from its yCurve and sUSD pools. The attacker used a flash loan to exploit a bug in the SavingsModule smart contract where the deposit logic minted tokens twice, allowing withdrawal of double the intended amount.

Hackers took advantage of the storage asset verification flaws in the Akropolis project of the Polkadot ecosystem to launch multiple consecutive reentry attacks on the contract, causing the Akropolis contract to issue a large number of pooltokens out of thin air without new asset injection, and then reuse these pooltokens. Withdrawing DAI from the YCurve and sUSD pools resulted in the loss of 2.03 million DAI in the project contract.