Decoding Earning Farm’s $528k Exploit | QuillAudits

Decoding Earning Farm’s $528k Exploit | QuillAudits

Decoding Earning Farm’s $528k Exploit | QuillAudits

Decoding Earning Farm’s $528k Exploit | QuillAudits

Decoding Earning Farm’s $528k Exploit | QuillAudits

Read Time: 4 minutes

Summary:

On the 9th of August 2023, Earning Farm from Aave protocol was attacked. The attack was made possible by a reentrancy vulnerability. And around $528k was stolen by the exploiter from the exploit.

About Project:

Earning Farm is a set of smart contracts that manage crypto assets. To learn more about them, check out their website.


Vulnerability Analysis & Impact:

On-Chain Details:

Attacker Address:  0xee4b3dd20902Fa3539706F25005fa51D3b7bDF1b

Victim Contract:  0xFe141C32E36Ba7601D128F0C39DEdBE0F6aBb983

Attack Transaction: 0x6e6e556a5685980317cb2afdb628ed4a845b3cbd1c98bdaffd0561cb2c4790fa


The Root Cause:

Although the root cause of the attack was reentrancy but a flawed business logic in burning the shares was also responsible for increasing the impact of the attack.

The withdraw() function was the function that the attacker reentered.

  • Notice how the withdrawing process is executed before burning the shares.
  • Upon close analysis a logical flaw was spotted.
    • If the sender has somehow less share than needed to be burnt, then only their balance will be burned.
    • Hence, when updating the balance of the `msg.sender` later, the result of `balanceOf` is already zero.

Attack Process:

  • First, the attacker took a FlashLoan of 10k ETH. 
  • The attacker then deposited 320 ETH into leveraged eth strategy of Earning Farm yield.
  • Soon after that,  the attacker withdrew the amount resulting in the attacker getting the sent eth.
  • The attacker then sent those shares to another contract that he created
  • Due to the flawed logic, nothing was burned from the attacker’s balance and he was able to get his original amount back. Then the remaining shares that were sent were also exchanged to execute the heist.

Flow of Funds:

Here is the fund flow during and after the exploit. You can see more details here.

Attacker’s Wallets:

Currently, all the funds residing in a bundle of 4 addresses with the majority of funds in these – 0x9d5765ae1c95c21d4cc3b1d5bba71bad3b012b68

0xe0afadad1d93704761c8550f21a53de3468ba599

Here is a snippet of one of the wallet address


After the Exploit

  • The Project hasn’t acknowledged the attack as of now.

Incident Timelines

Aug-09-2023 07:34:23 AM +UTC – A suspicious transaction was spotted on stETH to/from Aave Protocol.

Aug-09-2023 07:41:59 AM +UTC  – Another suspicious transaction was spotted.

Aug-10-2023 02:49:11 AM +UTC – The attacker transferred the stolen funds to multiple different addresses.


How could they have prevented the Exploit?

  • When dealing with business logic, it is crucial to write comprehensive Test Cases.
  • A non reentrant modifier is sometimes not enough to prevent reentrancy. It is important to analyze the flow of the contract and to carefully examine the exit points of the attacker.

The Imperative Need for Web3 Security

As a Web3 security firm QuillAudits, we embrace the essence of decentralization by offering transparency, and we want that spirit to shine through in our services too.

Want more Such Security Blogs & Reports?

Connect with QuillAudits on :

Linkedin | Twitter | Website | Newsletter | Discord | Telegram

Partner with QuillAudits :

2,896 Views

Blockchain for dog nose wrinkles' Ponzi makes off ~$127M🐶

Project promised up to 150% returns on investment in 100 days, raising about 166.4 billion South Korean won — or about $127 million — from 22,000 people.

Latest blogs for this week

Understanding Fuzzing and Fuzz Testing: A Vital Tool in Web3 Security

Read Time: 5 minutes When it comes to smart contracts, ensuring the robustness and security of code is paramount. Many techniques are employed to safeguard these contracts against vulnerabilities
Read More

How EigenLayer’s Restaking Enhances Security and Rewards in DeFi

Read Time: 7 minutes Decentralized finance (DeFi) relies on Ethereum staking to secure the blockchain and maintain consensus. Restaking allows liquid staking tokens to be staked with validators in
Read More

ERC 404 Standard: Everything You Need to Know

Read Time: 7 minutes Introduction Ethereum has significantly shaped the crypto world with its introduction of smart contracts and decentralized applications (DApps). This has led to innovative developments in
Read More

DNS Attacks:  Cascading Effects and Mitigation Strategies

Read Time: 8 minutes Introduction DNS security is vital for a safe online space. DNS translates domain names to IP addresses, crucial for internet functionality. DNS ensures unique name-value
Read More

EIP-4844 Explained: The Key to Ethereum’s Scalability with Protodanksharding

Read Time: 7 minutes Introduction  Ethereum, the driving force behind dApps, has struggled with scalability. High fees and slow processing have limited its potential. They have kept it from
Read More

QuillAudits Powers Supermoon at ETH Denver!

Read Time: 4 minutes Calling all the brightest minds and leaders in the crypto world! Are you ready to build, connect, and innovate at the hottest event during ETH
Read More

Decoding the Role of Artificial Intelligence in Metaverse and Web3

Read Time: 7 minutes Introduction  Experts predict a transformative shift in global software, driven by AI and ML, marking the dawn of a new era. PwC predicts AI will
Read More

Transforming Assets: Unlocking Real-World Asset Tokenization

Read Time: 7 minutes In the blockchain, real-world assets (RWAs) are digital tokens that stand for tangible and conventional financial assets, including money, raw materials, stocks, and bonds. As
Read More
Scroll to Top

Become a Quiffiliate!
Join our mission to safeguard web3

Sounds Interesting, Right? All you have to do is:

1

Refer QuillAudits to Web3 projects for audits.

2

Earn rewards as we conclude the audits.

3

Thereby help us Secure web3 ecosystem.

Total Rewards Shared Out: $200K+