Vyper incorrectly allocated named re-entrancy locks

Vulnerability

Overview

The vulnerability is a flaw in the Vyper compiler's handling of named re-entrancy locks, present in versions 0.2.15, 0.2.16, and 0.3.0 [1][3]. Each function using a @nonreentrant decorator with a given key is incorrectly allocated a unique lock, rather than sharing the same lock across functions that specify the same key [3]. This breaks the intended mutual exclusion, allowing re-entrancy between functions that should be protected by a single lock [3].

Exploitation

Conditions and Method

Exploitation requires a specific set of conditions: a contract compiled with a vulnerable Vyper version, a primary function that uses @nonreentrant(key) and performs an external call to an untrusted party before updating storage, and a secondary function that uses the same key and relies on consistent state [3]. The bug allowed attackers to bypass the re-entrancy guard, calling the secondary function re-entrantly from within the primary function's external call, as each function had its own independent lock [1]. This was the root cause of the July 30, 2023, Curve Finance pool exploits, where attackers drained several liquidity pools by exploiting this cross-function re-entrancy [1][2].

Impact

Attackers exploited this vulnerability to drain multiple Curve pools, resulting in losses of millions of dollars in various tokens, including WETH, msETH, alETH, and CRV [2]. The exploit demonstrates a significant security risk for contracts compiled with the affected Vyper versions, particularly those that do not strictly follow the check-effects-interaction pattern [1][2]. The impact was limited to contracts that meet all the specified conditions, but the Curve incident highlights the real-world consequences of the bug [1].

Mitigation

The Vyper team fixed the issue in version 0.3.1, which correctly allocates shared locks for functions using the same @nonreentrant key [1][3]. Users of affected Vyper versions should upgrade to 0.3.1 or later. No workaround exists for contracts already deployed; they must be redeployed using a patched compiler version [3].