{"investigation":{"slug":"conic-finance","entity_name":"Conic Finance","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.88,"status":"published","content_type":"investigation","summary":"Conic Finance was a DeFi liquidity-diversification protocol built on Curve Finance that allowed users to deposit assets into Omnipools across multiple Curve pools. On July 21, 2023, the protocol suffered two separate exploits totaling approximately $4.2 million — a $3.26 million read-only reentrancy attack on its ETH Omnipool and a subsequent $300,000 sandwich attack on its crvUSD Omnipool — after which TVL never recovered. In March 2025, the team formally shut down the protocol, citing an inability to fix critical security issues in a planned v2 upgrade.","sections":[{"content":"Conic Finance launched in March 2023 as a Curve Finance ecosystem protocol enabling liquidity providers to diversify single-asset deposits across multiple Curve pools simultaneously through its Omnipool mechanism. Within days of launch the protocol attracted over $60 million in TVL, reaching a peak of approximately $156 million. The protocol issued a governance token, CNC, which could be vote-locked (vlCNC) to direct pool allocations. Curve Finance founder Michael Egorov invested $1 million in the project at a $17 million valuation, announced in conjunction with audit funding. The protocol operated with an anonymous development team and no publicly identified founders.","heading":"Protocol Overview","sources":[{"url":"https://www.coindesk.com/markets/2023/03/08/curve-yield-farmers-rush-to-deploy-60m-on-newly-launched-conic-finance-capture-21-apy-on-usd-coin","name":"coindesk.com","type":"other","credibility":3},{"url":"https://medium.com/@ConicFinance/conic-raises-1m-f88ad30460fd","name":"medium.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/conic-finance","name":"defillama.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On July 21, 2023, at approximately 10:51 UTC, Conic Finance's ETH Omnipool was drained of 1,724 ETH worth approximately $3.26 million in a read-only reentrancy attack. The root cause was a flawed assumption in the CurveLPOracleV2 contract: Conic incorrectly assumed that Curve v2 pools using ETH would reference the ETH address (0xeeeeee...eee) rather than the WETH address. This caused the _isETH() method to return false for the rETH pool, bypassing the reentrancy guard entirely. The attacker (EOA: 0x8d67db0b205e32a5dd96145f022fa18aae7dc8aa) deployed a malicious contract (0x743599ba5cfa3ce8c59691af5ef279aaafa2e4eb) and used a $134 million flash loan to manipulate the CurveLPOracleV2 price oracle. By exploiting incomplete state during remove_liquidity() callbacks, the attacker could deposit and withdraw at a favorable exchange rate in a loop, minting excess cncETH LP tokens to drain the pool. The exploit transaction hash is 0x8b74995d1d61d3d7547575649136b8765acb22882960f0636941c44ec7bbe146. Stolen funds were forwarded to an associate address (0x3d32c5a2e592c7b17e16bddc87eab75f33ae3010) and remained largely untouched as of late July 2023. Notably, an identical class of vulnerability had been identified in a different Conic contract during a prior PeckShield audit, but the vulnerable oracle contract was outside that audit's scope and the team did not apply the lesson to newly deployed contracts.","heading":"July 2023 ETH Omnipool Exploit","sources":[{"url":"https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d","name":"medium.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/5FZAakbsUVg1EyHLNw9Qnm-conic-finance-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/tech/2023/07/21/defi-protocol-conic-finance-hacked-for-1700-ether","name":"coindesk.com","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/explained-the-conic-finance-hack-july-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://rekt.news/conic-finance-rekt","name":"rekt.news","type":"other","credibility":3}],"severity":"medium"},{"content":"Several hours after the ETH Omnipool attack on July 21, 2023, a second, unrelated exploit targeted Conic's crvUSD Omnipool. A separate attacker (0xb6369f59fc24117b16742c9dfe064894d03b3b80) executed a sandwich attack that exploited insufficient bounds on Curve pool imbalance checks. The attacker repeatedly exchanged crvUSD and USDC at favorable rates while depositing into and withdrawing from the Conic crvUSD Omnipool. The Omnipool's pool-balance assumptions had been destabilized by the earlier ETH exploit. Total funds extracted from the crvUSD pool amounted to approximately $934,000, of which the attacker realized a net profit of roughly $300,000 after costs. Conic detected the second attack at approximately 19:08 UTC and initiated a pool shutdown within 15 minutes. Nine ETH from this second exploit was subsequently routed to Tornado Cash. A frontrunner MEV bot also extracted some value during the chaotic period and voluntarily returned approximately 81 ETH (roughly 90 percent of its profit) to the Conic team.","heading":"July 2023 crvUSD Omnipool Exploit","sources":[{"url":"https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d","name":"medium.com","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/5FZAakbsUVg1EyHLNw9Qnm-conic-finance-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://www.merklescience.com/blog/hack-track-investigating-conic-finance-flow-of-funds","name":"merklescience.com","type":"other","credibility":3},{"url":"https://immunebytes.com/blog/conic-finance-detailed-hack-analysis-july-21/","name":"immunebytes.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Conic Finance had engaged PeckShield and ChainSecurity as auditors prior to the July 2023 exploits. PeckShield confirmed that the CurveLPOracleV2 contract — the direct source of the ETH Omnipool vulnerability — was not within the scope of their audit. ChainSecurity characterized the read-only reentrancy variant used in the attack as a novel class of vulnerability at the time. However, the post-mortem acknowledged that a functionally identical vulnerability had been identified in a different Conic contract during a prior audit cycle, and the team failed to systematically apply those findings to newly deployed contracts. Following the hacks, Conic engaged ChainSecurity and MixBytes to audit a planned v2 of the protocol, but the team ultimately announced in March 2025 that auditors and developers had been unable to produce sufficient fixes to the new version's security issues, citing this as a primary reason for shutdown.","heading":"Audit and Security Failures","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-conic-finance-hack-july-2023","name":"halborn.com","type":"other","credibility":3},{"url":"https://www.chainsecurity.com/security-audit/conic-protocol","name":"chainsecurity.com","type":"other","credibility":3},{"url":"https://medium.com/@ConicFinance/conic-is-shutting-down-70482910a5d1","name":"medium.com","type":"other","credibility":3},{"url":"https://immunebytes.com/blog/conic-finance-detailed-hack-analysis-july-21/","name":"immunebytes.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the July 21, 2023 exploits, the CNC governance token fell from approximately $6.00 to $2.75, a decline of roughly 54 percent. Protocol TVL dropped from a peak of approximately $156 million to approximately $111 million immediately after the incident. Conic paused all deposits and worked to contain the damage. By December 2023 the team announced a comeback attempt and CNC staged a 50 percent price recovery on expectations of a v2 launch. However, when the protocol's permanent shutdown was announced on March 7, 2025, CNC collapsed more than 80 percent to just over $0.01. All outstanding treasury CNC was burned upon shutdown.","heading":"Token Impact and Market Response","sources":[{"url":"https://www.coindesk.com/markets/2023/12/12/defi-platform-conic-finances-cnc-token-surges-50-as-the-protocol-plots-comeback-after-hack","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/149532/hackers-drain-3-2m-in-ethereum-from-defi-protocol-conic-finance","name":"decrypt.co","type":"other","credibility":3},{"url":"https://medium.com/@ConicFinance/conic-is-shutting-down-70482910a5d1","name":"medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On March 7, 2025, Conic Finance announced permanent closure of the protocol. The announcement stated that the team had worked with auditors but 'did not manage to come up with sufficient fixes to several issues of the new version,' leaving the team not confident enough to release a v2. The team also noted that several core developers had departed since the 2023 hacks. All Omnipools were shut down with deposits disabled; existing liquidity providers retained the ability to withdraw their funds. The CNC locker was deactivated, allowing all vote-locked token holders to exit regardless of remaining lock duration. The Conic UI was to remain accessible for three months to facilitate withdrawals, after which users would need to interact directly with contracts. Michael Egorov's $1 million investment was to be returned. As of March 2025, the protocol is fully defunct.","heading":"Protocol Shutdown","sources":[{"url":"https://medium.com/@ConicFinance/conic-is-shutting-down-70482910a5d1","name":"medium.com","type":"other","credibility":3},{"url":"https://www.dlnews.com/articles/defi/conic-calls-it-quits-after-failing-to-fix-security-flaws/","name":"dlnews.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Primary ETH Omnipool attacker EOA: 0x8d67db0b205e32a5dd96145f022fa18aae7dc8aa. Attack contract: 0x743599ba5cfa3ce8c59691af5ef279aaafa2e4eb. Funds receiver address: 0x3d32c5a2e592c7b17e16bddc87eab75f33ae3010 (held 1,727 ETH as of late July 2023). Exploit transaction: 0x8b74995d1d61d3d7547575649136b8765acb22882960f0636941c44ec7bbe146. Victim contract (ConicEthPool): 0xbb787d6243a8d450659e09ea6fd82f1c859691e9. crvUSD Omnipool attacker: 0xb6369f59fc24117b16742c9dfe064894d03b3b80; 9 ETH from this attack was routed to Tornado Cash. The primary 1,727 ETH from the first exploit was reported to remain untouched at the receiver address as of the Merkle Science analysis published in late July 2023. No recovery of the primary exploit funds has been publicly confirmed.","heading":"On-Chain Evidence and Fund Tracing","sources":[{"url":"https://www.certik.com/resources/blog/5FZAakbsUVg1EyHLNw9Qnm-conic-finance-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://www.merklescience.com/blog/hack-track-investigating-conic-finance-flow-of-funds","name":"merklescience.com","type":"other","credibility":3},{"url":"https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d","name":"medium.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2023-03-08","event":"Conic Finance launches; attracts over $60 million TVL within days offering Curve Omnipool diversification with up to 21% APY on USDC","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2023/03/08/curve-yield-farmers-rush-to-deploy-60m-on-newly-launched-conic-finance-capture-21-apy-on-usd-coin"},{"date":"2023-07-04","event":"First minor exploit of $1,600 via pool manipulation — an early signal of pool imbalance vulnerabilities","source":"CertiK Incident Analysis","source_url":"https://www.certik.com/resources/blog/5FZAakbsUVg1EyHLNw9Qnm-conic-finance-incident-analysis"},{"date":"2023-07-21","event":"ETH Omnipool drained of 1,724 ETH (~$3.26 million) via read-only reentrancy exploit exploiting a WETH/ETH address mismatch in CurveLPOracleV2","source":"Conic Finance Post-Mortem / CoinDesk","source_url":"https://www.coindesk.com/tech/2023/07/21/defi-protocol-conic-finance-hacked-for-1700-ether"},{"date":"2023-07-21","event":"crvUSD Omnipool exploited for ~$934,000 (~$300k attacker profit) via sandwich attack hours after the ETH exploit; 9 ETH routed to Tornado Cash","source":"Conic Finance Post-Mortem / CertiK","source_url":"https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d"},{"date":"2023-07-21","event":"Conic pauses all Omnipools and disables deposits; publishes incident acknowledgment; MEV bot voluntarily returns ~81 ETH","source":"Conic Finance Medium / Rekt News","source_url":"https://rekt.news/conic-finance-rekt"},{"date":"2023-07-22","event":"Conic Finance publishes full post-mortem detailing root cause of both exploits and committing to v2 development with fresh audits","source":"Conic Finance Medium","source_url":"https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d"},{"date":"2023-12-12","event":"CNC token surges 50% as Conic announces comeback plans and v2 development progress; TVL shows partial recovery","source":"CoinDesk","source_url":"https://www.coindesk.com/markets/2023/12/12/defi-platform-conic-finances-cnc-token-surges-50-as-the-protocol-plots-comeback-after-hack"},{"date":"2025-03-07","event":"Conic Finance announces permanent shutdown; team cites inability to fix critical security issues in v2 despite audits by ChainSecurity and MixBytes; CNC token falls over 80% on the announcement","source":"Conic Finance Medium / DL News","source_url":"https://medium.com/@ConicFinance/conic-is-shutting-down-70482910a5d1"}],"sources_used":[{"url":"https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d","name":"Conic Finance Post-Mortem — ETH and crvUSD Omnipool Exploits","type":"official","archive_url":"http://web.archive.org/web/20260610104508/https://medium.com/@ConicFinance/post-mortem-eth-and-crvusd-omnipool-exploits-c9c7fa213a3d","credibility":1,"archive_timestamp":"2026-06-10T10:45:08+00:00"},{"url":"https://medium.com/@ConicFinance/conic-is-shutting-down-70482910a5d1","name":"Conic is shutting down — Conic Finance Medium","type":"official","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/tech/2023/07/21/defi-protocol-conic-finance-hacked-for-1700-ether","name":"DeFi Protocol Conic Finance Hacked for 1,700 Ether — CoinDesk","type":"news_article","archive_url":"https://web.archive.org/web/20260725083933/https://www.coindesk.com/tech/2023/07/21/defi-protocol-conic-finance-hacked-for-1700-ether","credibility":1,"archive_timestamp":"2026-07-25T08:39:33+00:00"},{"url":"https://www.certik.com/resources/blog/5FZAakbsUVg1EyHLNw9Qnm-conic-finance-incident-analysis","name":"Conic Finance Incident Analysis — CertiK","type":"research","archive_url":"https://web.archive.org/web/20260725034825/https://www.certik.com/blog/5FZAakbsUVg1EyHLNw9Qnm-conic-finance-incident-analysis","credibility":2,"archive_timestamp":"2026-07-25T03:48:25+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-conic-finance-hack-july-2023","name":"Explained: The Conic Finance Hack (July 2023) — Halborn Security","type":"research","archive_url":"http://web.archive.org/web/20260415074509/https://www.halborn.com/blog/post/explained-the-conic-finance-hack-july-2023","credibility":2,"archive_timestamp":"2026-04-15T07:45:09+00:00"},{"url":"https://www.merklescience.com/blog/hack-track-investigating-conic-finance-flow-of-funds","name":"Hack Track: Investigating Conic Finance Flow of Funds — Merkle Science","type":"on_chain","archive_url":"http://web.archive.org/web/20260423023433/https://www.merklescience.com/blog/hack-track-investigating-conic-finance-flow-of-funds","credibility":2,"archive_timestamp":"2026-04-23T02:34:33+00:00"},{"url":"https://rekt.news/conic-finance-rekt","name":"Conic Finance — Rekt News","type":"news_article","archive_url":"http://web.archive.org/web/20251215201537/https://rekt.news/conic-finance-rekt","credibility":2,"archive_timestamp":"2025-12-15T20:15:37+00:00"},{"url":"https://www.dlnews.com/articles/defi/conic-finance-suffers-exploit-similar-to-the-dao-hack/","name":"Conic Finance suffers $3m exploit — DL News","type":"news_article","archive_url":"http://web.archive.org/web/20260617085609/https://www.dlnews.com/articles/defi/conic-finance-suffers-exploit-similar-to-the-dao-hack/","credibility":2,"archive_timestamp":"2026-06-17T08:56:09+00:00"},{"url":"https://www.dlnews.com/articles/defi/conic-calls-it-quits-after-failing-to-fix-security-flaws/","name":"Conic Finance shuts down more than a year after $3m exploits — DL News","type":"news_article","archive_url":"http://web.archive.org/web/20260617090345/https://www.dlnews.com/articles/defi/conic-calls-it-quits-after-failing-to-fix-security-flaws/","credibility":2,"archive_timestamp":"2026-06-17T09:03:45+00:00"},{"url":"https://cointelegraph.com/news/eth-curve-omnipool-platform-conic-finance-hacked-for-3-2-million-in-eth","name":"Curve omnipool platform Conic Finance hacked for $3.2M in ETH — CoinTelegraph","type":"news_article","archive_url":"http://web.archive.org/web/20260720154505/https://cointelegraph.com/news/eth-curve-omnipool-platform-conic-finance-hacked-for-3-2-million-in-eth","credibility":2,"archive_timestamp":"2026-07-20T15:45:05+00:00"},{"url":"https://decrypt.co/149532/hackers-drain-3-2m-in-ethereum-from-defi-protocol-conic-finance","name":"Hackers Drain $3 Million in Ethereum From DeFi Protocol Conic Finance — Decrypt","type":"news_article","archive_url":"http://web.archive.org/web/20260412140604/https://decrypt.co/149532/hackers-drain-3-2m-in-ethereum-from-defi-protocol-conic-finance","credibility":2,"archive_timestamp":"2026-04-12T14:06:04+00:00"},{"url":"https://www.theblock.co/post/240917/conic-finance-security-attack","name":"Conic Finance drained of $3.2 million in security attack — The Block","type":"news_article","archive_url":"https://web.archive.org/web/20260724174231/https://www.theblock.co/post/240917/conic-finance-security-attack","credibility":2,"archive_timestamp":"2026-07-24T17:42:31+00:00"},{"url":"https://medium.com/@ConicFinance/conic-raises-1m-f88ad30460fd","name":"Conic Finance raises $1m — Medium","type":"official","archive_url":null,"credibility":1,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/markets/2023/12/12/defi-platform-conic-finances-cnc-token-surges-50-as-the-protocol-plots-comeback-after-hack","name":"DeFi Platform Conic Finance CNC Token Surges 50% — CoinDesk","type":"news_article","archive_url":"https://web.archive.org/web/20260725190826/https://www.coindesk.com/markets/2023/12/12/defi-platform-conic-finances-cnc-token-surges-50-as-the-protocol-plots-comeback-after-hack","credibility":1,"archive_timestamp":"2026-07-25T19:08:26+00:00"},{"url":"https://immunebytes.com/blog/conic-finance-detailed-hack-analysis-july-21/","name":"Conic Finance Detailed Hack Analysis — ImmuneBytes","type":"research","archive_url":"http://web.archive.org/web/20250905131755/https://immunebytes.com/blog/conic-finance-detailed-hack-analysis-july-21/","credibility":2,"archive_timestamp":"2025-09-05T13:17:55+00:00"},{"url":"https://defillama.com/protocol/conic-finance","name":"Conic Finance — DefiLlama","type":"on_chain","archive_url":"http://web.archive.org/web/20250918003243/https://defillama.com/protocol/conic-finance","credibility":2,"archive_timestamp":"2025-09-18T00:32:43+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:40.301224+00:00","updated_at":"2026-08-29T01:33:59.074+00:00"}}