# the dForce exploit demonstrated cross-contract read-only reentrancy where stale Curve get_virtual_price values enabled artificial liquidation of lending positions
On February 9, 2023, an attacker exploited dForce's lending protocol on Arbitrum and Optimism for approximately $3.7 million. The attack demonstrates cross-contract read-only reentrancy: one protocol's view function returns stale data during another protocol's mid-execution state.
The attacker deposited into a Curve pool, then removed liquidity. During removal, Curve transferred ETH to the attacker's fallback function, which called dForce's lending functions. dForce used Curve's `get_virtual_price()` as a price oracle for LP token collateral. Because Curve had not finished updating internal state after the liquidity removal, `get_virtual_price()` returned a stale value. The manipulated virtual price triggered artificial liquidations at incorrect prices.
Since [[read-only reentrancy exploits view functions to cause other protocols to read inconsistent state]], this is a concrete instance of that pattern. The vulnerability exists in the trust relationship between dForce (price consumer) and Curve (price provider via view function). Standard reentrancy guards on Curve's state-modifying functions would not prevent this because `get_virtual_price()` is a view function that does not trigger mutex locks. Since [[flash loan oracle manipulation enables price feed attacks against defi protocols]], this shares the economic structure of oracle manipulation but achieves it through reentrancy rather than market impact.
Mitigation requires independent oracle sources that cannot be manipulated mid-transaction, or cross-contract reentrancy detection checking whether the source contract is mid-execution.
---
Relevant Notes:
- [[read-only reentrancy exploits view functions to cause other protocols to read inconsistent state]]: the general pattern this exploit instantiates
- [[flash loan oracle manipulation enables price feed attacks against defi protocols]]: shares the economic structure of oracle manipulation via a different mechanism
- [[reentrancy is possible whenever external calls precede state updates]]: the root cause mechanism enabling the stale state
- [[DeFi composability creates systemic exploit propagation risk because interconnected protocols transform local failures into cascades]]: cross-protocol trust as the attack surface
- [[liquidation cascades in lending protocols create self-reinforcing price collapse through forced selling feedback loops]]: the dForce exploit triggered artificial liquidations, the same mechanism that drives cascades in normal market stress
- [[Chainlink Proof of Reserve oracle feeds provide on-chain verification that tokenized asset supply matches off-chain reserves]]: independent oracle sources like Chainlink would have prevented reliance on the manipulable Curve view function
Topics:
- [[vulnerability-patterns]]
- [[exploit-analyses]]