---
title: "DeFi Protocols Rocked by Latest Hacks Exploiting Vyper Language Vulnerabilities"
url: https://diffcoin.com/defi-protocols-rocked-by-latest-hacks-exploiting-vyper-language-vulnerabilities/
description: "DeFi platforms BNB Smart Chain and Curve Finance have faced significant losses due to a vulnerability in the Vyper programming language."
published: 2023-07-31
updated: 2023-07-31
author: "Mila"
site: "Diffcoin"
---

# DeFi Protocols Rocked by Latest Hacks Exploiting Vyper Language Vulnerabilities

#### Share this article

Hackers have zeroed in on a vulnerability in the Vyper programming language — a well-known tool widely used for developing Web3 projects that target the Ethereum Virtual Machine (EVM) — on two significant DeFi protocols: BNB Smart Chain and Curve Finance.

Vyper is known for its similarities to Python, making it a common starting point for Python developers venturing into DeFi. The attacks in question [exploited](https://twitter.com/vyperlang/status/1685692973051498497) a flaw in the reentrancy lock of Vyper versions 0.2.15, 0.2.16, and 0.3.0, leading to multiple breaches across different protocols.

The losses have been significant across several platforms. On the BNB Smart Chain (BSC), there was reportedly multiple attacks due to the reentrancy lock vulnerability found in specific versions of Vyper (0.2.15, 0.2.16, 0.3.0) reported on July 30. Blockchain security firm BlockSec reported that these attacks led to a theft of around $41 million worth of cryptocurrencies.

> The sheet updated. Losses have already ~$41m! [pic.twitter.com/P7jG8NHnV4](https://t.co/P7jG8NHnV4)
> 
> — BlockSec (@BlockSecTeam) [July 30, 2023](https://twitter.com/BlockSecTeam/status/1685741725103583233?ref_src=twsrc%5Etfw)

Curve Finance, a DeFi protocol, [suffered](https://twitter.com/CurveFinance/status/1685693202722848768?s=20) even more on the same day. Several of its stable pools using the afflicted Vyper versions were exploited, with losses exceeding $47 million. A total of 32 million CRV tokens worth over $22 million were drained from the swap pool, as confirmed by Curve on Twitter.

> Someone drained 32 million [$CRV](https://twitter.com/search?q=%24CRV&src=ctag&ref_src=twsrc%5Etfw) from the swap pool, 0x8301ae4fc9c624d1d396cbdaa1ed877821d7c511 [pic.twitter.com/zQYivclTqO](https://t.co/zQYivclTqO)
> 
> — Andrew T (@Blockanalia) [July 30, 2023](https://twitter.com/Blockanalia/status/1685732007400079360?ref_src=twsrc%5Etfw)

The reentrancy lock is a critical component that should prevent multiple functions from being executed simultaneously. When correctly implemented, this guard would have thwarted the attackers. But in the case of the Vyper versions, the reentrancy guard was not implemented correctly, making a number of DeFi pools susceptible to attacks.

Several other DeFi projects have also reported losses, such as Ellipsis, which [reported](https://twitter.com/Ellipsisfi/status/1685695547271987200) an unspecified amount in BNB stable pools.

> A small number of stablepools with BNB using an old Vyper compiler have been exploited.
> 
> We are assessing the situation and will update the community on any further findings.
> 
> — Ellipsis (@Ellipsisfi) [July 30, 2023](https://twitter.com/Ellipsisfi/status/1685695547271987200?ref_src=twsrc%5Etfw)

#### Share this article

The information on or accessed through this website is obtained from independent sources we believe to be accurate and reliable, but Decentral Media, Inc. makes no representation or warranty as to the timeliness, completeness, or accuracy of any information on or accessed through this website. Decentral Media, Inc. is not an investment advisor. We do not give personalized investment advice or other financial advice. The information on this website is subject to change without notice. Some or all of the information on this website may become outdated, or it may be or become incomplete or inaccurate. We may, but are not obligated to, update any outdated, incomplete, or inaccurate information.

You should never make an investment decision on an ICO, IEO, or other investment based on the information on this website, and you should never interpret or otherwise rely on any of the information on this website as investment advice. We strongly recommend that you consult a licensed investment advisor or other qualified financial professional if you are seeking investment advice on an ICO, IEO, or other investment. We do not accept compensation in any form for analyzing or reporting on any ICO, IEO, cryptocurrency, currency, tokenized sales, securities, or commodities.

See full terms and conditions.

[Source link](https://cryptobriefing.com/defi-protocols-latest-hacks-exploiting-vyper/?utm_source=feed&utm_medium=rss)