Reentrancy attacks in 2022

Reentrancy on exitMarket() drained $80M from Rari Capital's Fuse lending pools, a function the team forgot to protect when patching reentrancy the prior month.

Voltage Finance's Fuse lending market lost $4M when ERC-677 tokens' transferAndCall hook enabled a reentrancy into the borrow function before debt was recorded.

$2M drained from Revest Finance via a reentrancy in mintAddressLock/depositAdditionalToFNFT that let the attacker mint over-valued NFTs and redeem them.

A joint cross-function reentrancy exploit drained ~$11M from Agave and Hundred Finance on Gnosis Chain via wETH/wXDAI's ERC-677-style transfer callback.

~$1.7M drained from Paraluni on BNB Chain after the deposit function accepted an unvalidated token with no reentrancy guard, letting a fake token re-enter.