Rari Fuse Reentrancy Hack
What happened
On April 30, 2022, an attacker drained approximately $80 million from Rari Fuse lending pools on Ethereum. An ETH transfer during borrowing allowed a callback into exitMarket() before the new debt had been recorded, breaking the connection between collateral withdrawal and outstanding borrowing.
borrow() transferred ETH before updating debt records. The callback could reach exitMarket() despite the borrowing path's reentrancy lock, so collateral checks used stale debt state.
How it happened
- Flash-borrowed assets were deposited into a Fuse pool as collateral.
- Borrowing ETH invoked the attacker's receiving contract before the protocol recorded the debt.
- Inside that callback,
exitMarket()removed the collateral market from the account's entered markets while the debt check still saw the earlier state. - The attacker withdrew collateral, repeated the sequence across affected markets, and repaid the flash liquidity.
Borrowing was paused after the incident. CertiK's analysis identifies the missing protection across functions, rather than a lack of any reentrancy lock.
Later reimbursement was a separate process. In September 2022, Babylon Finance reported receiving $3.12 million from FEI for affected users. Compensation paid by a DAO is not proof that the attacker returned the stolen assets.
Protocol details
Funds Recovery
Recovered
$79.7M
Net Loss
$0
Evidence
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
