Native ETH removeLiquidity reentrancy lets an LP swap against withdrawn stale reserves

removeLiquidity() sends native ETH to the LP before it reduces the hook’s reserves or burns LP shares. The receive callback can call the already-unlocked PoolManager’s swap() directly. That swap is priced against reserves that still include the LP’s withdrawn liquidity.

In the Foundry PoC, the same 9,999 ETH exact-output swap costs about 10 times less input in the reentrant path than after an ordinary withdrawal. The honest side is left with 1 ETH. The full write-up has the affected code, test output, and remediation. Cantina’s public leaderboard records one High and one Medium for this competition.