Curve Finance awards dev $250k for finding reentrancy vulnerability

Curve Finance awarded cybersecurity researcher Marco Croc with its maximum bug bounty award of $250,000 after thoroughly investigating the security flaw.

A security researcher was rewarded $250,000 for discovering a vulnerability that has historically allowed hackers to pull out millions of dollars from cryptocurrency protocols. 

Pseudonymous cybersecurity researcher Marco Croc from Kupia Security identified a reentrancy vulnerability in decentralized finance (DeFi) protocol Curve Finance.

In an X thread, he explained how the bug could be exploited to manipulate balances and withdraw funds from liquidity pools.

Read more