Reaper Farm Hack

Reported loss $1.7M
Fantom
Other

What happened

In early August 2022, an attacker drained about $1.7 million from Reaper Farm's multi-strategy vaults on Fantom. Its new ReaperVaultV2 vaults implemented the ERC-4626 withdraw and redeem functions but never checked that the caller owned the shares being burned, or had an allowance to spend them. Anyone could withdraw any depositor's funds to their own address. Several vault deployments used the same code and all were hit the same way.

The attacker bridged the proceeds from Fantom to Ethereum and laundered them through Tornado Cash. After finding the bug, the Reaper team used it themselves to pull the remaining funds out of the still-vulnerable vaults. It then published a recovery plan to repay affected users from the sale of vested OATH tokens from its treasury plus other treasury assets.

Attacker address (A): 0x5636e55e4a72299a0f194c001841e2ce75bb527a Receiving address (B, Fantom and Ethereum): 0x2c177d20b1b1d68cc85d3215904a7bb6629ca954 Attacker contract: 0x8162a5e187128565ace634e76fdd083cb04d0145 (created in 0xe7635f32b7e073186445d6400c83d429f130b34921a32347afbce10eefbdc607) Example withdrawals: 0xc929f3b9312ff26be0adb1c3ff832dbdafdcbcaad33d002744effd515e53c9d5, 0x24770e104ae1f8f47d1c095046379557ba3d17e49d3186e5f46f22d1067a57e9, 0x7f79934a9c2fb01e3f7af57939746cfdc4b3854ecfff712b84a593e60d8e3754 Example bridge transactions: 0x2fa4eb1813a77a143b72006c682733a54eddef43fb1a0ec2b85b448a830a8913, 0x345b6f910bd318f1ab5df7c67effd4e808a202ac1f9c186bf69af7c6f49d5504, 0x551f875e2a9bf101f52e8138248ed74bc5201d9029ca7171c6c0a605c9a12e9d

How it happened

  1. ReaperVaultV2 exposed ERC-4626 withdraw(assets, receiver, owner) and redeem(shares, receiver, owner). Both passed the caller-supplied owner straight into _withdraw.
  2. _withdraw called _burn(owner, shares) and transferred the assets to receiver. It never required msg.sender == owner and never spent an allowance.
  3. From address A, the attacker deployed a contract that called these functions with vault depositors as owner and address B as receiver, repeating the call across users and vault deployments.
  4. The stolen assets were bridged from Fantom to Ethereum and deposited into Tornado Cash.
  5. The Reaper team used the same flaw to rescue the remaining funds from the vulnerable vaults.

Protocol details

Classification Yield Aggregator / Access Control
Protocol Type Yield Aggregator
Implementation language Solidity
Protocol links Website @Reaper_Farm

Security review history

Evidence

Understand the attack patterns

Compare incidents →
Access Control Attacks

Same attack technique

Browse all hacks →
BNB Chain SNOOKER $198K lost BNB Chain ShadowFi $303K lost BNB Chain Feminist Metaverse $540K lost BNB Chain Umbrella Network $700K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes