Hook: A call to a function named mergeLiquidityPools in the Reunion Protocol’s smart contract exposes a critical reentrancy vulnerability that could drain all funds within a single transaction. The exploit path is not novel—it’s a variant of the 2016 DAO attack—but the protocol’s architecture amplifies the blast radius. I discovered this during a routine audit triggered by a 1,200% spike in the protocol’s TVL following a celebrity endorsement from a prominent football club. The numbers looked too good. They were.
Context: The Reunion Protocol is a DeFi platform that claims to unify the liquidity of two of the largest lending protocols on Ethereum—let’s call them Alpha and Beta. The pitch is simple: users deposit assets into Reunion, which then rebalances them across Alpha and Beta to maximize yield while minimizing slippage. The protocol’s native token, $REUNION, was launched via a viral marketing campaign tied to the rumored transfer of two elite footballers (Bernardo Silva and Kylian Mbappe) to Real Madrid. The team used this narrative to attract retail liquidity, raising $20 million in a private sale. The codebase is a fork of Compound V2 with custom upgradeable proxy contracts. The core innovation is an automated arbitrage bot that executes cross-pool trades within the same block, claiming to offer “zero-latency, zero-slippage” yield. But the team’s technical whitepaper, which I reviewed line by line, omits any discussion of oracle attack vectors or the economic implications of time-weighted average price (TWAP) manipulation. The stakes are high: at the time of my audit, the protocol held $150 million in assets, with 80% of that in a single ETH-USDC pool.
Core: Let’s dive into the mergeLiquidityPools function. The contract uses a single external oracle (a Chainlink price feed) to determine the exchange rate between tokens when rebalancing. The vulnerability lies in the calcRebalanceAmount helper: it calls oracle.getLatestPrice() without any staleness check. In a bear market, with low liquidity, a single malicious transaction can manipulate the oracle’s value by triggering a flash loan attack on the underlying pool. I simulated this attack vector using a custom fork of the Ethereum mainnet at block 19,500,000. The exploit requires only $500,000 in flash loan capital to drain the protocol of $5 million in USDC. The attack flow is: 1) flash loan ETH from a lending protocol, 2) swap a large amount of ETH for USDC on the underlying pool to move the price, 3) call mergeLiquidityPools with a manipulated price, 4) drain the Reunion pool by overvaluing the USDC being withdrawn. The contract’s onlyRebalancer modifier is insufficient—the rebalancer is a multi-sig wallet controlled by the team, but the oracle manipulation happens before the rebalancer even acts. The code assumes that the rebalancer will always execute within the same block as the price update, but the flash loan allows the attacker to front-run the rebalancer’s transaction. I reported this to the team, and they dismissed it as “theoretical,” arguing that the mining costs would be prohibitive. But the cost of a flash loan is negligible (less than 0.01% of the loan amount), and the profit is 10x the capital. Based on my audit experience, this is a classic “economic exploit” that will be exploited within the first week of mainnet launch if unpatched. The team’s response was to add a 5-minute time delay on the oracle price, but this only reduces the frequency of attacks, not the risk. The core issue is that the protocol’s design optimizes for yield, not security. Trust is not a variable you can optimize away.
Beyond the oracle, the mergeLiquidityPools function lacks a slippage check. The rebalancer can set a slippageTolerance parameter, but the default is 5%, which is absurdly high for a stablecoin pair. In a bear market, when volatility spikes, a 5% slippage could be triggered by a single large trade, causing the protocol to rebalance at a loss. I stress-tested the contract with historical data from the May 2022 UST depeg scenario. The protocol would have lost 30% of its assets in a single day. The team’s justification was that “high slippage allows for aggressive rebalancing to capture arbitrage opportunities.” But this is a false economy: the protocol is designed to be a “set and forget” yield maximizer, but the lack of safety checks makes it a high-risk, high-volatility vehicle. The code is elegant, but the math is broken.
Contrarian: The blind spot in most audits of this protocol is the assumption that the rebalancer is a trusted entity. But the rebalancer contract is upgradeable, and the team’s multi-sig has three signers—two of whom are anonymous. The protocol’s governance token distribution gives the team 40% of all $REUNION tokens, with a one-year lockup. This creates a classic principal-agent problem: the team is incentivized to increase the protocol’s TVL to pump the token price before the lockup expires, even if it means taking on hidden risks. The “merger” narrative—combining two legendary protocols—is a marketing gimmick to attract liquidity, but it masks the fact that the protocol is a centralized entity with a high-risk oracle dependency. The contrarian take is that the real vulnerability is not the code, but the economic incentives. The protocol’s whitepaper claims that the rebalancer is “protocol-owned liquidity,” but the rebalancer can be funded by the team’s treasury, which is controlled by the same multi-sig. This is a centralization risk that cannot be audited away. The market makers who would provide quotes for the protocol’s tokens are the same ones who benefit from the rebalancer’s arbitrage profits. It’s a closed loop. The protocol’s true risk is not technical, but sociological: the trust in the team is misplaced. The signature “Trust is not a variable you can optimize away” applies here—the protocol has optimized for capital efficiency, but it has optimized trust away entirely.
Takeaway: The Reunion Protocol is a ticking bomb. The merge of two liquidity pools is a clever idea, but the execution is flawed. The team’s decision to use a single oracle without staleness checks, combined with a high-slippage rebalancer and anonymous governance, creates a vector for a fund-draining attack. The next bear market, when liquidity dries up and flash loans become cheaper, will be the trigger. The protocol’s $150 million TVL is a target. My recommendation: do not deposit assets until the team implements a decentralized oracle with multiple price feeds and a minimum staleness check of 10 seconds, and adds a slippage guard of 0.1% for stablecoin pairs. But even then, the centralization risk remains. The real question is: who is the rebalancer? Until that identity is disclosed, the protocol is a black box. The crypto market will learn this lesson the hard way, again.
