# Conic Finance: read-only reentrancy drains ETH omnipool

Read-only reentrancy during Curve LP removal let attacker manipulate Conic ETH pool oracle prices and drain ~$3.25M via flash-loan-funded deposits/withdrawals.

- Payout: Real-world hack
- Severity: critical
- Program: Conic Finance
- Analysis by: DeFiHackLabs
- Disclosed: 2023-07-21
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2023-07/Conic_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20230721-conic
- Tags: area:web3 domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:flash-loan vuln:misconfiguration vuln:oracle-manipulation vuln:reentrancy

**Target:** Conic ETH omnipool and Curve LP oracle
**Root cause:** Conic's oracle read Curve LP token prices while the pool was mid-withdrawal (read-only reentrancy), so manipulated LP prices were trusted; combined with a misconfigured pool allowing repeated deposits.
**Steps:**
1. Flash loan stETH (20k) via Aave v2, cbETH (850) via Aave v3, and rETH/cbETH/WETH via Balancer
2. Loop 7x: `ConicEthPool.deposit(1214 ether,0,false)` then swap cbETH/rETH to WETH on Curve to skew LP prices
3. reenter_1: withdraw WETH, `LidoCurvePool.add_liquidity` to mint steCRV, then `remove_liquidity` to enter read-only reentrancy while oracle reads steCRV price
4. reenter_2/reenter_3: repeat manipulation on cbETH_ETH and rETH_ETH pools to skew oracle prices
5. Withdraw all cncETH from ConicEthPool at inflated value, swap back, repay flash loans
**How found:** Post-mortem analysis identified that Conic's oracle read Curve LP token prices during remove_liquidity, a read-only reentrancy window; BlockSec flagged the misconfiguration enabling repeated deposits.
**Exploitation:** Attacker flash-loaned stETH, cbETH, rETH and WETH, repeatedly deposited into ConicEthPool while skewing Curve LP prices, then triggered read-only reentrancy during Curve remove_liquidity so Conic's oracle read manipulated LP prices; withdrew cncETH at inflated value and repaid loans, netting ~$3.25M.
**Escalation:** Chained three flash-loan sources (Aave v2, Aave v3, Balancer) and multiple Curve pools to amplify price skew across steCRV, cbETH_ETH and rETH_ETH LPs.
**Insight:** When a protocol prices LP tokens via an external pool's get_virtual_price or oracle, check whether that read can occur mid-withdrawal (read-only reentrancy) — Curve remove_liquidity is a classic window; also audit deposit caps/loop limits that let attackers repeat skewing.