DFX Finance

On 2022-11-10 DFX Finance's swapping contracts were exploited for roughly $5M when an attacker used flashloans to manipulate the contract's balance checks. By depositing flashloaned tokens during the loan callback, the attacker bypassed repayment verification, obtained LP tokens from deposit(), and then withdrew underlying CAD and USDC assets; transaction links and the attacker contract are provided. The vulnerability is a design flaw allowing flashloaned tokens to be used to 'repay' loans via deposit(), and the report recommends adding reentrancy-style guards; impacted protocols were paused at the time of writing.