Vyper Incident Analysis

## Executive summary On 30 July 2023 a malfunctioning reentrancy lock in Vyper compiler versions 0.2.15, 0.2.16 and 0.3.0 was exploited in multiple DeFi pools (notably the pETH-ETH-f pool), resulting in roughly $69.3M removed and $52M net loss across six projects; the report details the attack flow, involved wallets, timeline, and remediation guidance recommending upgrades to non-vulnerable Vyper versions.