coinnounce.com
The decentralized finance project Grim Finance alerted its uses to an attack this weekend. The team stated that the platform had been exploited by an “external attacker” that has made off with $30 million worth of crypto assets. The Grim Finance team revealed that it was an advanced attack in which the hacker exploited the protocol’s vault contract. It added that the vaults have been paused and recommended that user withdraw their funds.
Grim Finance’s smart contracts were exploited out of $30 million.
Grim Finance calls itself a “compounding yield optimizer” which employs complex vault strategies to offer boosted yields from liquidity provider tokens. Around an hour before the attack that exploited smart contracts, the attacker pre-funded Grim Finance’s Ethereum and Binance Smart Chain wallets using Tornado Cash. The stolen crypto was bridged from the Fantom network on which Grim is based to Ethereum before being converted into USDC and DAI. The firm stated that the exploit was found in the vault contract, so all vaults and deposited funds are currently at risk.
The hacker tricked the protocol with a reentrancy attack.
The hacker tricked the protocol with a reentrancy attack which creates additional fake deposits into a vault while an initial transaction is still ongoing. “We have contacted and notified Circle (USDC), DAI, and AnySwap regarding the attacker address to potentially freeze any further fund transfers,” the firm stated. The Grim Finance team said that they had reopened the “Tshare Masonry Vault” so that users could withdraw before it gets permanently closed. The protocol’s native GRIM token dumped 80% at the time of the hack in a fall from $0.794 to $0.151, according to CoinGecko. GRIM is currently down 89% from its Oct 20 all-time high of $1.84.