Growth DeFi Rug Pull
Reported loss
$1.4M
Flashloan Price Oracle Attack
What happened
The attacker's address:
The attacker created a fake token called AXZ and supplied rAXZZ/GRO liquidity. He then staked it in the contract and pulled out the other pair.
The attacker:
- Swapped 0.001 WETH for ~0.0148 GRO:
- Added ~0.0148 GRO and 100,000,000,000 AXXZ into Uniswap liquidity pair:
- Removed ~27,516 GRO and ~1,218 rAAVE liquidity from Uniswap:
- Swapped ~27,516 GRO for ~597 WETH and ~1,218 rAAVE on ~203 WETH:
Stolen funds were distributed between 4 external wallets at:
Protocol details
Classification
Ecosystem / Yield Aggregator / Input Validation
Protocol Type
Yield
Affected asset / contract
GRO
Implementation language
Solidity
Protocol links
Website
@GrowthDefi
Security review history
- ConsenSys Diligence View report
Evidence
- report Post-mortem rekt.news
- report Post-mortem rekt.news
- analysis Website reference growthdefi.medium.com
- analysis DeFiLlama defillama.com
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
