Earning Farm Hack

Earning Farm was exploited via Flash Loan Attack resulted in a loss of 1,365,750 $USD worth of $ETH

Earning Farm is a Yield Aggregator running on the Ethereum chain. The project suffered from a Flash Loan Attack and lost roughly 750 $ETH in total. The attacker was able to receive 268 $ETH while the rest of the stolen funds were siphoned by MEV Bot.

The attacker deployed a malicious smart contract with unverified source code, and exploited EFLeverVault contract's logic issue. Security check for a callback initiator was missing in the affected contract, which allowed the attacker to drain the vault contract's $ETH. All the stolen funds were transferred through TornadoCash.

Attacker address:

https://etherscan.io/address/0xdf31f4c8…de4d5f

Malicious transaction:

https://etherscan.io/tx/0x160c5950…dda01e

Malicious contract:

https://etherscan.io/address/0x140cca42…699388