Leaderboard
538All-time rank
Reaper Farm
Aug 1, 2022
$1.7M
Lost
$1.7M
Recovered
$0
Net loss
$1.7M
Unrecovered0% recovered
ReaperVaultV2 contract's withdraw function failed to validate vault share ownership. Attackers exploited this access control flaw to destroy other users' vault shares and withdraw tokens from multiple vaults.
How the exploit worked
View reproducible PoCBusiness Logic Flaw : Lack of access control mechanism.
Lost: Multiple ERC-20 Tokens (~1.7M US$)
Source: DeFiHackLabs (SunWeb3Sec)
- Target
- DeFi
- Classification
- Access Control
- Technique
- Improper Access Control
- Attribution
- Unknown
- Chains
Fantom
Event timeline
- Aug 1, 2022Exploit executed — $1.7M drained via improper access control
- Attributed to Unknown
- Recovery status Unrecovered 0%
Data credits
- DefiLlamaIncident record, amounts, chains, recovery data and logo
- DeFiHackLabsExploit analysis and reproducible proof-of-concept (by SunWeb3Sec)