Curriculum·G205 Monitoring, Alerting, and Response·about 31 min
Your runbook when a position is at risk
By the end of this lesson you can
- →Explain what a runbook is: a set of actions decided before an incident so the response clock is execution, not deliberation
- →Explain how the Rari and Fei Fuse pools were drained of about 80 million dollars by a reentrancy exploit that spread pool by pool
- →Compute the order of actions when a position is at risk: confirm, assess exposure, exit, revoke, and warn
- →Write a personal runbook for the positions you hold before you need it
Graduate · enrolled learners
This lesson opens with Rari Capital and Fei Protocol Fuse, 30 April 2022.
- What happened
- Rari Capital's Fuse let anyone spin up isolated lending pools from a fork of the Compound code, and Rari had merged with Fei Protocol under the Tribe DAO. On 30 April 2022 an attacker exploited a reentrancy vulnerability in the Fuse pools: the borrow path made an external call before it updated its own accounting, so the attacker could re-enter during that call and borrow against collateral the pool had not yet debited. The exploit was run across multiple pools, draining about 80 million dollars in total. Because the pools shared the vulnerable code, the attack spread from one to the next, and users with funds in Fuse had a narrow, chaotic window as it did. Tribe DAO later voted to reimburse affected users and then to wind the protocol down.
- The decision point
- When the Fuse exploit was running, users with funds in the pools faced the worst possible conditions for a good decision: minutes, high stakes, incomplete information, and an exploit spreading through code they could not read. That is precisely when deliberation fails, and it is why the response clock from the last lesson is only fast if the thinking was done beforehand. A runbook is that prior thinking: a written sequence of actions for when a position is at risk, decided in calm and executed in panic. It answers, before the moment, how you confirm an alert is real, how you find your exposure, in what order you act, and what you can and cannot control. The Fuse users who fared best were the ones who already knew where their funds were and how to pull them; a runbook is how you become that user before the day you need to be.
- Recorded loss
- $80,000,000
What you will be able to answer
- →What drained the Rari and Fei Fuse pools?
- →What is a runbook?
- →What order of actions when a position is at risk?
- →Why does a runbook matter most in the worst conditions?
Orientation and Year One are open: anyone can read them without an account. From Year Two onward the lessons are for enrolled learners, because progress through the later years only means anything if it is tracked against a record.
It is free. We do not sell the list and there is nothing to buy at the end of it.
Sources and review
- https://rekt.news/rari-capital-rekt/
- https://www.halborn.com/blog/post/explained-the-rari-capital-hack-april-2022
- https://response.pagerduty.com/
Confidence high·Volatility medium·Reviewed 2026-09-14·Owner unassigned
Contested
The Rari and Fei Fuse loss is reported at about 80 million dollars; figures near 79 to 80 million appear across sources depending on asset prices. The reentrancy mechanism in the forked Fuse code is well documented, as is the shared-code spread across pools.
Tribe DAO's subsequent votes to reimburse users and then wind the protocol down are matters of governance record; this lesson uses the incident for the runbook point, which the fast, multi-pool spread supports.