Reentrancy attacks in 2024

A reentrancy in Clober DEX's Rebalancer withdraw path on Base let an attacker re-enter before LP accounting settled, draining $500K in excess liquidity.

~$27M drained from Penpie after a reentrancy gap in Pendle's plugin integration let the attacker register a malicious market and pull pegged rewards in one tx.

Attacker extracted $6.4M from Astroport on Terra via an IBC-hooks reentrancy patched in April, then reintroduced in a June upgrade. ASTRO fell 60%.