# Paribus: reentrancy in pETH redeem drains lending pools

Paribus, a Compound V2 fork on Arbitrum, suffered a reentrancy during pETH redeem, letting an attacker borrow all pUSDT and pWBTC and drain ~$100k.

- Payout: Real-world hack
- Severity: high
- Program: Paribus
- Analysis by: DeFiHackLabs
- Disclosed: 2023-04-11
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-04/Paribus_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230411-paribus
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity vuln:flash-loan vuln:reentrancy

**Target:** Compound V2 fork lending protocol (pETH, pUSDT, pWBTC markets) on Arbitrum
**Root cause:** The pETH redeem function transfers ETH before updating state, allowing a reentrant call to borrow other markets while the attacker's collateral position was still inflated.
**Steps:**
1. Flash loan 200 WETH and 30,000 USDT from Aave V3.
2. Deploy Exploiter contract, send 100 WETH, call `mint()` to convert WETH to ETH and mint pETH.
3. In the main contract, convert remaining WETH to ETH, mint pETH, mint pUSDT with USDT, enter markets pETH and pUSDT.
4. Borrow 13.075 ETH worth of pETH, then call `pETH.redeem(pETH.balanceOf(this))` to trigger the reentrancy.
5. During the ETH transfer in redeem, the receive() fallback (nonce==2) calls `pUSDT.borrow(USDT.balanceOf(pUSDT))` and `pWBTC.borrow(WBTC.balanceOf(pWBTC))`.
6. Exploiter contract redeems its pETH, converts ETH back to WETH, and returns funds.
7. Swap borrowed USDT and WBTC to WETH via Curve to repay flash loan and keep profit.
**How found:** Known reentrancy issue from forked old Compound V2 code; attacker likely identified the redeem function's external call before state update.
**Exploitation:** Attacker used an Aave flash loan to fund initial capital, minted pETH and pUSDT, entered markets, borrowed a small amount of ETH, then triggered redeem. The reentrancy in the ETH transfer callback allowed borrowing all available USDT and WBTC from the protocol while the attacker's collateral was still counted. Borrowed assets were swapped to WETH on Curve, flash loan repaid, net ~$100k profit.
**Escalation:** Reentrancy during redeem allowed draining multiple markets (pUSDT and pWBTC) beyond the initial pETH borrow.
**Insight:** When auditing Compound V2 forks, check the order of operations in redeem: if ETH is sent before the borrower's balance is reduced, a reentrant fallback can borrow other assets while collateral is still counted.