What happened
On October 14, 2022, an attacker drained about 748 ETH (roughly $950,000-$960,000 at the time) from Earning.farm's EFLeverVault on Ethereum in two flash-loan attacks. The vault's flash-loan callback did not check that the vault itself had started the loan. That let an outside contract start a Balancer flash loan with the vault as recipient, so Balancer ran the vault's callback and the vault unwound its position and released its ETH.
An MEV bot intercepted the first attack and captured about 480 ETH. The attacker's second attack took about 268 ETH. Etherscan labels the attacker 0xdf31f4c8dc9548eb4c416af26dc396a25fde4d5f as Earning.Farm Exploiter, and the attack contract is 0x140cca423081ed0366765f18fc9f5ed299699388.
How it happened
- The attacker deployed an unverified contract (
0x140cca...9388) and used it to start a zero-fee WETH flash loan from the Balancer Vault with EFLeverVault (0xe39fd820...c3D309) named as the recipient. In transaction0x160c5950a01b88953648ba90ec0a29b0c5383e055d35a7835d905c53a3dda01e, Balancer sent the 560 WETH to the vault. - Balancer then invoked EFLeverVault's flash-loan callback. The callback did not verify that the vault had initiated the loan.
- Running its normal deleveraging logic, the vault repaid its loan position, released about 833 stETH of collateral from Aave V2 and swapped the stETH to ETH through Curve.
- The attacker then withdrew the ETH left in the vault. In the first attempt an MEV bot intercepted the attack and took about 480 ETH; the attacker's second attempt kept about 268 ETH.
Protocol details
Evidence
- report @danielvf incident report twitter.com
- report @Supremacy_CA incident report twitter.com
- transaction Etherscan transaction 0x160c5950...a3dda01e etherscan.io
- address etherscan.io address 0x140c…9388 etherscan.io
- address etherscan.io address 0xdf31…4d5f etherscan.io
- analysis Earning.farm Yield Platform Under Attack: Details u.today
- analysis DeFiLlama defillama.com
- analysis Weekly Blockchain Security Watch (Fairyproof, October 17, 2022) fairyproof.substack.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
