The @SolvProtocol BitcoinReserveOffering contract was reportedly exploited, resulting in a loss of ~$2.7M. The root cause is a reentrancy issue caused by an unintended interaction between mint() and the ERC721 receiver callback. When redeeming the entire value of an ERC-3525 SFT, the contract transferred the SFT via safeTransferFrom (doSafeTransferIn), triggering onERC721Received. The callback immediately minted BRO based on the SFT value. After returning, mint() resumed and minted BRO again for the same value, effectively double-counting the asset. By repeatedly cycling burn → mint, the attacker amplified their BRO balance, inflating a small initial amount into a large supply and ultimately exchanging it for SolvBTC to realize the profit. Attack TX: app.blocksec.com/phalcon/explo...…