Growth DeFi hack — February 2021

Growth DeFi was exploited on 8 February 2021 through the single-asset deposit function of its stkGRO/rAAVE staking contract on Ethereum. The team's post-mortem, published the same day, described the flaw precisely: the function accepted a token address and a Uniswap pool address without checking that the token was one of the two assets in the pool.

The attacker created a worthless ERC-20, paired it with GRO in a Uniswap V2 pool, and deposited it. The contract routed the deposit through the fake pool and credited the resulting fake LP shares as if they were genuine GRO/rAAVE LP shares, minting staking shares against no additional reserve. The attacker redeemed those shares for real GRO/rAAVE LP tokens, removed the liquidity to obtain GRO and rAAVE, and sold them on Uniswap for roughly 800 ETH in total. Growth DeFi withdrew the remaining treasury liquidity from the staking contracts once it detected the attack.

This incident is often filed as a flash loan or price oracle attack, and Smart Contract Hacking tags it that way. Neither description matches the post-mortem, and Smart Contract Hacking's own narrative describes no flash loan and no oracle step: the root cause was missing input validation on the token/pool pair.

The total drained is reported as $1.4 million, of which the team said 12 percent, or $168,000, belonged to users rather than the protocol treasury. It issued $168,000 of SAFE tokens pro rata to pre-exploit stakers, to be bought back at up to $1 each out of future protocol fees, and migrated rAAVE to a new non-rebasing token, PMINE. This was a deferred buyback commitment contingent on future revenue, not an immediate repayment, and covered only the user-owned share; there is no public confirmation that the buyback was completed.

No individual or group has been named as responsible.