{"investigation":{"slug":"earningfarm","entity_name":"Earning.Farm","trust_score":22,"severity_base":null,"score_modifier":0,"confidence":0.78,"status":"published","content_type":"investigation","summary":"Earning.Farm is an Ethereum-based DeFi yield aggregator that deployed leveraged yield strategies on top of Aave. The protocol suffered two distinct security incidents — a flash loan attack in October 2022 that drained approximately 750 ETH (~$950,000), followed by a reentrancy exploit in August 2023 that resulted in an additional ~$528,000 loss. The protocol has been flagged by ZachXBT and has shown no evidence of recovery, compensation to users, or resumed operations following either incident.","sections":[{"content":"Earning.Farm is a decentralized finance (DeFi) yield aggregator protocol deployed on the Ethereum mainnet. The protocol offered leveraged yield farming strategies, primarily by routing user deposits through Aave lending markets to generate amplified returns. Key contracts included EFVault (the main vault handling user deposits) and EFLeverVault (a leveraged vault component). Users deposited ETH, Wrapped Bitcoin (wBTC), and USDC into the protocol in exchange for ENF_ETHLEV tokens representing their leveraged position. The protocol was audited by blockchain security firm SlowMist prior to its public launch. Despite holding a prior security audit, the protocol was successfully attacked on two separate occasions due to unaddressed smart contract vulnerabilities.","heading":"Protocol Overview","sources":[{"url":"https://medium.com/neptune-mutual/how-was-the-earning-farm-exploited-9802135793ab","name":"medium.com","type":"other","credibility":3},{"url":"https://www.binance.com/en-NG/feed/post/938964","name":"binance.com","type":"other","credibility":3},{"url":"https://crypto.news/287000-reportedly-stolen-in-hack-targeting-aaves-earning-farm/","name":"crypto.news","type":"other","credibility":3}],"severity":"medium"},{"content":"On or around October 14-15, 2022, blockchain security firm Supremacy Inc. publicly disclosed that Earning.Farm's EFLeverVault contract had been targeted by two successive flash loan attacks. The root vulnerability was an architectural flaw in the EFLeverVault contract: the contract failed to verify that flash loan callbacks were legitimately initiated by the protocol itself, allowing an attacker to instruct the contract to execute unauthorized large-scale withdrawals of collateral. In the first attack, an MEV (Maximal Extractable Value) bot front-ran the attacker's transaction, capturing 480 ETH. The second attacker successfully executed their transaction and extracted 268 ETH. The combined loss across both attack transactions totaled approximately 748-750 ETH, valued at roughly $950,000 based on ETH prices at the time (approximately $1,300 per ETH). No restitution to affected users was publicly confirmed following this incident.","heading":"October 2022 Flash Loan Attack","sources":[{"url":"https://u.today/earningfarm-yield-platform-under-attack-details","name":"u.today","type":"other","credibility":3},{"url":"https://www.investing.com/news/cryptocurrency-news/287000-reportedly-stolen-in-hack-targeting-aaves-earning-farm-3150404","name":"investing.com","type":"other","credibility":3},{"url":"https://www.supremacy.team/","name":"supremacy.team","type":"other","credibility":3}],"severity":"medium"},{"content":"On August 9, 2023, Earning.Farm suffered a second major security incident, this time a reentrancy attack on the EFVault contract. Blockchain security firm PeckShield was among the first to publicly flag the incident. The attacker (operating from address 0xee4b3dd20902Fa3539706F25005fa51D3b7bDF1b) exploited a logic error in the EFVault contract's withdraw function, which transferred ETH to the caller before updating the ENF_ETHLEV share balances. This allowed the attacker to re-enter the contract and repeatedly burn small amounts of LP tokens to extract ETH, compounded by a faulty share-burning business logic that amplified the attack's impact. The attacker first took a flash loan of 80,000 ETH, deposited approximately 320 ETH to receive ENF_ETHLEV tokens, then exploited the reentrancy flaw across nine separate transactions. Stolen funds (291.64 ETH, approximately $528,000) were consolidated into two wallets: 0x9d5765ae1c95c21d4cc3b1d5bba71bad3b012b68 and 0xe0afadad1d93704761c8550f21a53de3468ba599. The attack transaction hash is 0x6e6e556a5685980317cb2afdb628ed4a845b3cbd1c98bdaffd0561cb2c4790fa. The victim contract address is 0xFe141C32E36Ba7601D128F0C39DEdBE0F6aBb983.","heading":"August 2023 Reentrancy Exploit","sources":[{"url":"https://www.quillaudits.com/blog/hack-analysis/earning-farm-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://medium.com/neptune-mutual/how-was-the-earning-farm-exploited-9802135793ab","name":"medium.com","type":"other","credibility":3},{"url":"https://crypto.news/287000-reportedly-stolen-in-hack-targeting-aaves-earning-farm/","name":"crypto.news","type":"other","credibility":3},{"url":"https://u.today/breaking-earning-farm-on-aave-protocol-hit-immediate-action-needed","name":"u.today","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the August 2023 reentrancy exploit, the Earning.Farm team sent an on-chain message to the attacker's address offering 10% of the stolen assets (approximately $52,800) as a bounty in exchange for the return of the remaining funds and a commitment to cease all investigation and tracking efforts with third-party security agencies. The team did not communicate publicly about the incident through their official social media channels at the time the Neptune Mutual post-mortem was published. No evidence has been found in publicly available sources that the attacker responded to the bounty offer or returned any stolen funds. No compensation mechanism, restitution plan, or user recovery fund has been publicly announced for either the 2022 or 2023 incidents. The protocol's operational status following August 2023 remains unclear, with no verifiable evidence of resumed operations, new audits, or user communications.","heading":"Team Response and Recovery Efforts","sources":[{"url":"https://medium.com/neptune-mutual/how-was-the-earning-farm-exploited-9802135793ab","name":"medium.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/earning-farm-exploit","name":"quillaudits.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Earning.Farm's contracts were audited by SlowMist, a prominent blockchain security firm, prior to the protocol's public launch. Despite this audit, the protocol suffered two separate critical exploits — one in October 2022 and a second in August 2023. The 2022 flash loan vulnerability stemmed from the EFLeverVault contract's failure to validate the origin of flash loan callbacks, a known class of vulnerability in DeFi protocols. The 2023 reentrancy attack exploited the absence of non-reentrant modifiers on the EFVault's withdraw function, a class of vulnerability widely documented since the 2016 DAO hack. Security analysts at Neptune Mutual and QuillAudits noted that the inherited ERC-20 methods in EFVault lacked non-reentrant guards, and that a simple mutex (non-reentrant modifier) would have prevented the August 2023 exploit. The failure of the SlowMist audit to identify these vulnerabilities prior to deployment, and the protocol team's failure to patch the flash loan vulnerability before a second, distinct class of attack succeeded, are significant red flags regarding the protocol's security posture and ongoing risk management practices.","heading":"Security Audit Failure and Vulnerability Analysis","sources":[{"url":"https://medium.com/neptune-mutual/how-was-the-earning-farm-exploited-9802135793ab","name":"medium.com","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/earning-farm-exploit","name":"quillaudits.com","type":"other","credibility":3},{"url":"https://www.binance.com/en-NG/feed/post/938964","name":"binance.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On-chain investigator ZachXBT has flagged Earning.Farm as a risky entity, contributing to its inclusion in AVOID.NET's trust intelligence database. ZachXBT is a widely cited independent blockchain investigator known for tracking stolen funds, identifying scam protocols, and documenting DeFi exploits. The protocol's pattern of repeated exploits, lack of transparent user communication following each incident, unrecovered funds, and apparent operational cessation following the August 2023 hack collectively represent significant risk signals for users. The protocol's history — two separate critical smart contract failures within approximately ten months — suggests systemic weaknesses in the development and security review process. Users who interacted with Earning.Farm are advised to revoke any remaining token approvals to the EFVault and EFLeverVault contracts to prevent further exposure.","heading":"ZachXBT Flag and Community Risk Signals","sources":[{"url":"https://crypto.news/287000-reportedly-stolen-in-hack-targeting-aaves-earning-farm/","name":"crypto.news","type":"other","credibility":3},{"url":"https://u.today/breaking-earning-farm-on-aave-protocol-hit-immediate-action-needed","name":"u.today","type":"other","credibility":3},{"url":"https://www.quillaudits.com/blog/hack-analysis/earning-farm-exploit","name":"quillaudits.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2022-10-14","event":"Earning.Farm's EFLeverVault contract is targeted by two successive flash loan attacks. A total of approximately 750 ETH (~$950,000) is drained: 480 ETH captured by an MEV bot front-running the attacker, and 268 ETH extracted by the attacker directly. Supremacy Inc. publicly discloses the incident.","source":""},{"date":"2023-08-09","event":"A reentrancy attacker exploits a logic flaw in EFVault's withdraw function across nine transactions, taking a flash loan of 80,000 ETH and draining 291.64 ETH (~$528,000 at the time). PeckShield alerts the community. Stolen funds are moved to two consolidation wallets.","source":""},{"date":"2023-08-10","event":"Attacker transfers stolen funds to consolidation addresses. Earning.Farm team sends on-chain message to the attacker offering a 10% bounty (~$52,800) in exchange for return of remaining funds and cessation of third-party investigations. No public response from attacker is recorded.","source":""}],"sources_used":[{"url":"https://medium.com/neptune-mutual/how-was-the-earning-farm-exploited-9802135793ab","name":"medium.com","type":"other","archive_url":"http://web.archive.org/web/20251009201441/https://medium.com/neptune-mutual/how-was-the-earning-farm-exploited-9802135793ab","credibility":3,"archive_timestamp":"2025-10-09T20:14:41+00:00"},{"url":"https://www.binance.com/en-NG/feed/post/938964","name":"binance.com","type":"other","archive_url":"https://web.archive.org/web/20260829144001/https://www.binance.com/en-NG/square/post/938964","credibility":3,"archive_timestamp":"2026-08-29T14:40:01+00:00"},{"url":"https://crypto.news/287000-reportedly-stolen-in-hack-targeting-aaves-earning-farm/","name":"crypto.news","type":"other","archive_url":"http://web.archive.org/web/20251017181921/https://crypto.news/287000-reportedly-stolen-in-hack-targeting-aaves-earning-farm/","credibility":3,"archive_timestamp":"2025-10-17T18:19:21+00:00"},{"url":"https://u.today/earningfarm-yield-platform-under-attack-details","name":"u.today","type":"other","archive_url":"http://web.archive.org/web/20250907073248/https://u.today/earningfarm-yield-platform-under-attack-details","credibility":3,"archive_timestamp":"2025-09-07T07:32:48+00:00"},{"url":"https://www.investing.com/news/cryptocurrency-news/287000-reportedly-stolen-in-hack-targeting-aaves-earning-farm-3150404","name":"investing.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.supremacy.team/","name":"supremacy.team","type":"other","archive_url":"http://web.archive.org/web/20260706091212/https://www.supremacy.team/","credibility":3,"archive_timestamp":"2026-07-06T09:12:12+00:00"},{"url":"https://www.quillaudits.com/blog/hack-analysis/earning-farm-exploit","name":"quillaudits.com","type":"other","archive_url":"http://web.archive.org/web/20260515105305/https://www.quillaudits.com/blog/hack-analysis/earning-farm-exploit","credibility":3,"archive_timestamp":"2026-05-15T10:53:05+00:00"},{"url":"https://u.today/breaking-earning-farm-on-aave-protocol-hit-immediate-action-needed","name":"u.today","type":"other","archive_url":"http://web.archive.org/web/20250918052442/https://u.today/breaking-earning-farm-on-aave-protocol-hit-immediate-action-needed","credibility":3,"archive_timestamp":"2025-09-18T05:24:42+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:39.157229+00:00","updated_at":"2026-08-30T12:41:17.282275+00:00"}}