removeLiquidity() sends native ETH to the LP before it reduces the hook’s reserves or
burns LP shares. The receive callback can call the already-unlocked PoolManager’s
swap() directly. That swap is priced against reserves that still include the LP’s
withdrawn liquidity.
In the Foundry PoC, the same 9,999 ETH exact-output swap costs about 10 times less input in the reentrant path than after an ordinary withdrawal. The honest side is left with 1 ETH. The full write-up has the affected code, test output, and remediation. Cantina’s public leaderboard records one High and one Medium for this competition.