DeFi protocol Grim Finance said about $30 million was stolen by hackers exploiting a reentrancy vulnerability in their platform. A security flaw in the protocol allowed the attacker to fake five additional deposits.
In a statement posted to Twitter on Saturday, Grim Finance said “an advanced attack” was taking place and initially paused all vaults to prevent more attacks.
“The exploit was found in the vault contract so all of the vaults and deposited funds are currently at risk,” the company explained. “We have contacted and notified Circle (USDC), DAI, and AnySwap regarding the attacker address to potentially freeze any further fund transfers.”
Solidity Finance, a DeFi auditing firm that audited Grim Finance and missed the vulnerability, said the cause of the issue was “the ability of users to input arbitrary addresses and have them called within the depositFor function.”
