ChainCatcher message: According to the latest statistics from blockchain security company Certik, there have been 8 reentrancy attack incidents from the beginning of 2024 to date, resulting in a total loss of approximately 30 million dollars. Among them, the attack on Penpie has become the largest reentrancy attack incident of 2024, and it is also the third largest reentrancy attack since January 2021.In terms of loss scale, the Penpie attack is second only to the Grim Finance attack that occurred in December 2021 (with losses of approximately 40 million dollars) and the Vyper vulnerability incident in July 2023 (with losses of approximately 52 million dollars).

ChainCatcher message, according to the analysis by the Beosin security team, the root cause of the attack on the JPEG'd project lies in a reentrancy issue.It is reported that the attacker added liquidity through reentrancy into the add_liquidity function while calling the remove_liquidity function to remove liquidity. Since the balance update occurs before reentrancy into the add_liquidity function, this leads to an error in price calculation.