Clober Dex - Rekt

Clober Dex's Liquidity Vault lost $500k in a reentrancy exploit after post-audit code changes were deployed without a proper security review. According to Nick Franklin's breakdown, the attacker abused the burnHook callback in the unguarded _burn function, withdrawing 133 ETH. PeckShield tracked the funds as they were bridged from Base to Ethereum mainnet and split between two addresses. Trust Security said the vulnerable change was audited by another firm, Kupia Security, which had flagged potential issues with malicious strategies, while Clober said those warnings were unrelated to the exploit. Raz0r of Decurity said the burnHook call appeared to be a post-audit addition.