# CloberDEX Rebalancer: burn-hook reentrancy drains WETH vault

CloberDEX Rebalancer vault reentrancy via burn hook let attacker re-burn LP to drain 133.7 WETH (~$501K) from the WETH/fake-token pool.

- Payout: Real-world hack
- Severity: critical
- Program: CloberDEX
- Credited: DeFiHackLabs
- Disclosed: 2024-12-10
- Write-up quality: 7/10
- Original: https://github.com/SunWeb3Sec/DeFiHackLabs/blob/main/src/test/2024-12/CloberDEX_exp.sol
- Library page: https://bugbountylibrary.com/r/dhl%3A20241210-cloberdex
- Tags: domain:web3 impact:funds-loss kind:incident platform:defihacklabs sev:critical tech:evm tech:solidity technique:chained vuln:flash-loan vuln:reentrancy

**Target:** Rebalancer liquidity vault (open/mint/burn with hooks)
**Root cause:** The Rebalancer invokes an external burnHook callback during burn() before state is finalized, allowing reentrant burn() of the same LP position to withdraw pool assets twice.
**Steps:**
1. Flash loan 2x rebalancer WETH balance from Morpho Blue via `flashLoan(weth, amountToHack, "0")`.
2. Deploy FakeToken; call `rebalancer.open(bookKeyA, bookKeyB, "1", address(this))` to create WETH/FakeToken pool with attacker as strategy/hook.
3. Approve FakeToken and WETH to rebalancer.
4. Call `rebalancer.mint(poolKey, amountToHack, amountToHack, 0)` to mint LP.
5. Call `rebalancer.burn(poolKey, rebalancerWETH, 0, 0)`; inside burnHook reenter `rebalancer.burn(key, rebalancerWETH, 0, 0)` once (reEntry guard) to double-withdraw WETH.
6. Repay flash loan, withdraw WETH to ETH, send to attacker.
**How found:** Attacker likely noticed burn() calls an external hook (burnHook) before completing accounting, enabling reentrancy on the shared Rebalancer vault; pairing with a fake token let them mint cheap LP against real WETH.
**Exploitation:** Attacker flash-borrowed 2x the vault's WETH, seeded a pool with a worthless fake token, minted LP, then triggered burn() whose burnHook reentered burn() to extract WETH twice from the shared vault, netting 133.7 WETH.
**Escalation:** Flash loan amplified capital to 2x vault balance so the double-burn drained the entire WETH reserve.
**Insight:** Vaults that share liquidity across permissionlessly-created pools and invoke user-supplied hooks during burn/mint are reentrancy-prone; check whether hook callbacks fire before balance/state finalization and whether a worthless paired token can mint LP against real assets.