Incident Overview
Earning Farm was exploited via Flash Loan Attack resulted in a loss of 1,365,750 $USD worth of $ETH
Earning Farm is a Yield Aggregator running on the Ethereum chain. The project suffered from a Flash Loan Attack and lost roughly 750 $ETH in total. The attacker was able to receive 268 $ETH while the rest of the stolen funds were siphoned by MEV Bot.
The attacker deployed a malicious smart contract with unverified source code, and exploited EFLeverVault contract's logic issue. Security check for a callback initiator was missing in the affected contract, which allowed the attacker to drain the vault contract's $ETH. All the stolen funds were transferred through TornadoCash.
Attacker address:
https://etherscan.io/address/0xdf31f4c8…de4d5f
Malicious transaction:
https://etherscan.io/tx/0x160c5950…dda01e
Malicious contract:
https://etherscan.io/address/0x140cca42…699388
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Earning Farm, these are the critical security checks that could have prevented this incident (October 2022).
- Verify all logic paths related to Flash Loan Attack are guarded by proper access controls and input validation - see the Flash Loans Attacks attack class for patterns
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- SlowMist Report unavailable
Related Attack Classes
The technique used in this hack maps to these vulnerability classes in our security curriculum:
Sources & References
Learn to Prevent the Next Earning Farm
The Earning Farm hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.