Grim Finance Hack

TOTAL LOST $30.0M

High Dec 18, 2021 Flash Loan Attacks Fantom

What happened

On December 18, 2021, an attacker drained Grim Finance's Fantom yield vaults through the vault share-minting path. The attacker supplied a malicious token contract to GrimBoostVault.depositFor, then used that token's safeTransferFrom callback to re-enter the function before the outer calls completed. Each nested call observed an earlier pool balance, while the final call introduced the real LP tokens.

When execution unwound, the vault minted shares repeatedly against the same balance increase. Those excess vault shares could be redeemed for more SpiritSwap LP tokens than the attacker had deposited. Contemporary reporting and the project's public statements put the loss at more than, or about, $30 million.

Technical Root Cause

GrimBoostVault.depositFor trusted a caller-provided token contract and made its external safeTransferFrom call before completing share-accounting state. A malicious token re-entered the function, allowing multiple frames to mint shares from one genuine LP-token balance increase.

Case & protocol details

Classification Reentrancy / unvalidated token parameter

Protocol Type Yield

Affected asset / contract GRIM

Smart Contract Language Solidity

Official Website www.grim.finance/

Protocol Twitter/X @financegrim

Attacker Address 0xdefc385d7038f391eb0063c2f7c238cfb55b206c

Attack Timeline

The vulnerable depositFor function accepted a caller-selected token address. It took a pool-balance snapshot, invoked safeTransferFrom on that supplied address, then calculated the received amount from the later balance and minted vault shares. The attacker's token contract re-entered depositFor several times.

In the last nested call, genuine LP tokens increased the vault balance. As the nested calls returned, several frames treated that one increase as their own deposit and minted shares repeatedly. The attacker redeemed the inflated shares, removed liquidity, repaid borrowed liquidity, and moved the remainder.