# the dForce exploit demonstrated cross-contract read-only reentrancy where stale Curve get_virtual_price values enabled artificial liquidation of lending positions On February 9, 2023, an attacker exploited dForce's lending protocol on Arbitrum and Optimism for approximately $3.7 million. The attack demonstrates cross-contract read-only reentrancy: one protocol's view function returns stale data during another protocol's mid-execution state. The attacker deposited into a Curve pool, then removed liquidity. During removal, Curve transferred ETH to the attacker's fallback function, which called dForce's lending functions. dForce used Curve's `get_virtual_price()` as a price oracle for LP token collateral. Because Curve had not finished updating internal state after the liquidity removal, `get_virtual_price()` returned a stale value. The manipulated virtual price triggered artificial liquidations at incorrect prices. Since [[read-only reentrancy exploits view functions to cause other protocols to read inconsistent state]], this is a concrete instance of that pattern. The vulnerability exists in the trust relationship between dForce (price consumer) and Curve (price provider via view function). Standard reentrancy guards on Curve's state-modifying functions would not prevent this because `get_virtual_price()` is a view function that does not trigger mutex locks. Since [[flash loan oracle manipulation enables price feed attacks against defi protocols]], this shares the economic structure of oracle manipulation but achieves it through reentrancy rather than market impact. Mitigation requires independent oracle sources that cannot be manipulated mid-transaction, or cross-contract reentrancy detection checking whether the source contract is mid-execution. --- Relevant Notes: - [[read-only reentrancy exploits view functions to cause other protocols to read inconsistent state]]: the general pattern this exploit instantiates - [[flash loan oracle manipulation enables price feed attacks against defi protocols]]: shares the economic structure of oracle manipulation via a different mechanism - [[reentrancy is possible whenever external calls precede state updates]]: the root cause mechanism enabling the stale state - [[DeFi composability creates systemic exploit propagation risk because interconnected protocols transform local failures into cascades]]: cross-protocol trust as the attack surface - [[liquidation cascades in lending protocols create self-reinforcing price collapse through forced selling feedback loops]]: the dForce exploit triggered artificial liquidations, the same mechanism that drives cascades in normal market stress - [[Chainlink Proof of Reserve oracle feeds provide on-chain verification that tokenized asset supply matches off-chain reserves]]: independent oracle sources like Chainlink would have prevented reliance on the manipulable Curve view function Topics: - [[vulnerability-patterns]] - [[exploit-analyses]]