Paraluni Exploit

On March 13, 2022 Paraluni’s MasterChef contract was exploited via a reentrancy flaw combined with improper validation of the pool ID (_pid). The attacker deployed malicious ERC-20 tokens, used a flash loan to obtain LP tokens, triggered reentrant deposits to create duplicate accounting entries, withdrew assets, and converted/bridged proceeds (eventually depositing ~660 ETH to Tornado), resulting in about $1.7M stolen; the report provides technical analysis, relevant addresses/txs, and root-cause vulnerability details.