Leaderboard
577All-time rank
Growth DeFi
Feb 9, 2021
$1.4M
Lost
$1.4M
Recovered
$0
Net loss
$1.4M
Unrecovered0% recovered
On 8 February 2021 an attacker created a worthless rAXZZ token and a GRO/rAXZZ Uniswap pool, then used the single-asset deposit feature of Growth DeFi's stkGRO/rAAVE farming contract which failed to validate LP token identity, accepting the GRO/rAXZZ LP shares as legitimate GRO/rAAVE LP shares, allowing the attacker to mint 14,513 stkGRO/rAAVE shares and drain the pool.
- Target
- DeFi
- Classification
- Input Validation
- Technique
- Missing Input Validation
- Attribution
- Unknown
- Chains
Ethereum
Event timeline
- Feb 9, 2021Exploit executed — $1.4M drained via missing input validation
- Attributed to Unknown
- Recovery status Unrecovered 0%
