# ArcadiaFi: reentrancy in vaultManagementAction drains lending pools

Reentrancy in ArcadiaFi's vaultManagementAction let attacker re-enter liquidateVault mid-action, draining ~$400k of WETH/USDC from Optimism lending pools.

- Payout: Real-world hack
- Severity: high
- Program: ArcadiaFi
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-10
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/ArcadiaFi_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230710-arcadiafi
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:high tech:evm tech:solidity technique:chained vuln:business-logic vuln:flash-loan vuln:reentrancy

**Target:** ArcadiaFi LendingPool / Vault on Optimism
**Root cause:** vaultManagementAction executes an attacker-supplied actionHandler multicall that transfers vault assets out before state is settled, allowing re-entry into liquidateVault on the now-empty vault while leverage funds remain.
**Steps:**
1. Flash loan WETH and USDC from Aave V3 on Optimism.
2. `Factory.createVault(15113, 1, WETH)` to create Proxy1; call `openTrustedMarginAccount(darcWETH)`.
3. Deposit flash-loaned WETH as collateral via `Proxy1.deposit(...)`.
4. Call `darcWETH.doActionWithLeverage(WETH.balanceOf(darcWETH)-1e18, Proxy1, ActionMultiCall, callData1, 0)` to borrow leveraged WETH into the vault.
5. Build `callData2` with ActionMultiCall targeting WETH `approve(helper, max)` and `helper.rekt()`, then call `Proxy1.vaultManagementAction(ActionMultiCall, callData2)`.
6. Inside `rekt()`, re-enter `darcWETH.liquidateVault(Proxy1)` after assets were moved out, capturing liquidation proceeds.
7. Repeat the same flow for USDC via Proxy2 and darcUSDC.
8. Repay Aave flash loan; keep remaining WETH/USDC (~$400k).
**How found:** Likely spotted that vaultManagementAction performs arbitrary external calls (actionHandler multicall) before finalizing vault accounting, enabling reentrancy into liquidateVault.
**Exploitation:** Attacker flash-borrows WETH/USDC, opens leveraged margin vaults, then uses vaultManagementAction to route vault assets to an attacker helper contract which re-enters liquidateVault on the emptied vault, extracting the pool's funds; flash loan repaid, profit retained.
**Escalation:** Chained leveraged borrowing with reentrant self-liquidation to convert borrowed pool liquidity into attacker profit.
**Insight:** In leveraged-vault designs, check whether user-controlled actionHandler multicalls run before collateral/accounting state is committed; a self-call to liquidateVault mid-action can settle the vault against stale balances.