{"investigation":{"slug":"growth-defi","entity_name":"Growth DeFi","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"Growth DeFi is a Binance Smart Chain (BSC) yield aggregator and DeFi ecosystem founded in 2020, offering the GRO governance token, the WHEAT yield optimizer, and the MOR overcollateralized stablecoin. On February 8, 2021, the protocol suffered a flashloan price oracle exploit targeting its stkGRO/rAAVE staking contract, resulting in approximately $1.3–1.4 million in stolen funds with no full recovery. As of 2026, the protocol has an extremely low TVL of roughly $22,000 and the GRO token trades at near-zero valuations, indicating near-complete abandonment.","sections":[{"content":"Growth DeFi launched in August 2020 on Ethereum before expanding to Binance Smart Chain (BSC). Its core products include the GRO governance token (since migrated to xGRO), the WHEAT yield optimizer, and the MOR overcollateralized stablecoin, which allows users to borrow at zero or negative interest rates against collateral positions. The named development team includes Rodrigo Ferreira (backend head developer, PhD in Computer Science from Yale) and Irving Cabello Almazán (frontend head developer). The protocol positioned itself as a capital-efficiency layer atop established DeFi primitives including Aave, Curve, and Mooniswap. The GRO token launched at approximately $19.66 on August 26, 2020, with a maximum supply of 1,000,000 tokens.","heading":"Overview","sources":[{"url":"https://coinbureau.com/review/growth-defi-gro/","name":"coinbureau.com","type":"other","credibility":3},{"url":"https://growthdefi.medium.com/mor-capital-efficiency-for-bsc-a-novel-way-to-borrow-and-get-paid-for-doing-so-by-growth-20c97b542633","name":"growthdefi.medium.com","type":"other","credibility":3},{"url":"https://www.crowdfundinsider.com/2021/09/180372-growth-defi-integrates-chainlink-price-feeds-to-support-lending-liquidation-other-services-for-mor-stablecoin-release/","name":"crowdfundinsider.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On February 8, 2021 at approximately 06:17 PM UTC, an attacker exploited a critical vulnerability in the stkGRO/rAAVE staking contract on Ethereum. The attacker created a fraudulent ERC-20 token named rAXZZ and paired it with GRO in a fake Uniswap V2 liquidity pool. Exploiting the absence of validation checks tying deposited tokens to the legitimate GRO/rAAVE pool assets, the attacker deposited 19,900,000,000,000 rAXZZ into the stkGRO/rAAVE contract and minted approximately 14,513 stkGRO/rAAVE shares out of thin air. The stolen funds — approximately 801 ETH at the time, equivalent to roughly $1.3–1.4 million — were distributed across four external wallets. The attacker address was 0x5e05bc89ae5f21b48500d9685526e0dab421a04b. No funds were recovered. Approximately 12% of total losses (approximately $168,000) belonged directly to user deposits. The protocol had previously undergone a Consensys Diligence audit of its V1 contracts in December 2020, yet the vulnerability was introduced in a later contract update. The team responded by issuing 168,000 SAFE tokens to affected stkGRO/rAAVE holders and migrating from rAAVE to a new non-rebasing token, gROOT, deployed on BSC.","heading":"Security Exploit — February 2021","sources":[{"url":"https://growthdefi.medium.com/raave-farming-contract-exploit-explained-f3b6f0b3c1b3","name":"growthdefi.medium.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/growthdefihack.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://smartcontractshacking.com/hacks/growth-defi-hack-2021","name":"smartcontractshacking.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Consensys Diligence conducted an audit of Growth DeFi V1 smart contracts between November 23 and December 11, 2020. The audit flagged concerns about 'loose definitions of many states, roles, and permissions,' particularly with respect to the owner role, and noted that 'future plans to transition this role to a DAO-governed multisig have not been well thought through.' A second Consensys Diligence audit was conducted in June 2021 covering the GrowthDeFi WHEAT protocol. CertiK separately audited the MOR contract, delivered on November 18, 2021, with Growth DeFi onboarded to CertiK on January 20, 2022. The CertiK Skynet score was not activated for the project at time of investigation, returning no active trust metrics. The February 2021 exploit occurred after the first Consensys audit and prior to the WHEAT and MOR audits, demonstrating that audited V1 code did not cover the attack surface of new contract deployments.","heading":"Audit History and Pre-Exploit Security Warnings","sources":[{"url":"https://consensys.net/diligence/audits/2020/12/growth-defi-v1/","name":"consensys.net","type":"other","credibility":3},{"url":"https://diligence.consensys.io/audits/2021/06/growthdefi-wheat/","name":"diligence.consensys.io","type":"other","credibility":3},{"url":"https://www.certik.com/projects/growthdefi","name":"certik.com","type":"other","credibility":3},{"url":"https://smartcontractshacking.com/hacks/growth-defi-hack-2021","name":"smartcontractshacking.com","type":"other","credibility":3}],"severity":"medium"},{"content":"Following the February 2021 exploit, the Growth DeFi team announced that affected users who held rAAVE in the stkGRO/rAAVE farming contracts would receive SAFE token airdrops to BSC wallets proportional to their holdings. The team stated SAFE tokens 'will be bought up in the future for up to $1 each' as protocol fees accumulate. Community members criticized the compensation approach, arguing that affected users should have been compensated at pre-hack token valuations rather than post-dump prices. The team delayed V2 product launches pending additional Consensys Diligence audits, reflecting a more conservative post-incident security posture. A migration from GRO to xGRO was subsequently executed with a 1:1 airdrop, consolidating the ecosystem onto BSC.","heading":"Compensation and Post-Exploit Response","sources":[{"url":"https://growthdefi.medium.com/the-future-of-raave-58be3063dfdb","name":"growthdefi.medium.com","type":"other","credibility":3},{"url":"https://brittanyd.medium.com/raave-to-groot-whats-next-for-growth-defi-bda76c7d9a6f","name":"brittanyd.medium.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/casestudy/growthdefihack.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://growthdeficommunity.medium.com/growth-defi-community-recap-february-2021-f0ca4d9c9064","name":"growthdeficommunity.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"As of May 2026, Growth DeFi's total value locked (TVL) stands at approximately $22,249 across all chains, with the vast majority on Avalanche and effectively zero on BSC and Fantom, according to DefiLlama. The GRO token is listed on CoinMarketCap as having undergone a contract migration; the original GRO contract shows a circulating supply of approximately 433,370 tokens. The xGRO contract shows a total and max supply of 1,000,000 with 0 circulating supply listed on its preview page with a CertiK security score of 2.7. Multiple price aggregators report near-zero or absent price data, with no significant trading volume observed. CoinMarketCap has flagged the original GRO token as migrated. The protocol app at app.growthdefi.com remains nominally accessible but community activity appears minimal. The extreme decline in TVL from its 2021 peak to approximately $22,000 represents a near-complete collapse in protocol usage.","heading":"Current Protocol Status and Market Activity","sources":[{"url":"https://defillama.com/protocol/growth-defi","name":"defillama.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/growthdefi/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://coinmarketcap.com/currencies/growthdefi-new/","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://www.bitdegree.org/crypto-tracker/top-bsc-dapps/growth-defi","name":"bitdegree.org","type":"other","credibility":3}],"severity":"medium"},{"content":"Growth DeFi has been flagged by blockchain investigator ZachXBT, whose investigations have documented the February 2021 exploit and the subsequent protocol decline. ZachXBT is an independent on-chain analyst known for documenting DeFi exploits, fund tracing, and identifying fraudulent activity. The specific nature and scope of ZachXBT's flagging of Growth DeFi beyond the 2021 exploit could not be confirmed through primary source verification at the time of this investigation. Claims beyond the documented hack attribution are treated as low-confidence pending primary source confirmation.","heading":"ZachXBT Flag","sources":[{"url":"https://en.wikipedia.org/wiki/ZachXBT","name":"en.wikipedia.org","type":"other","credibility":3},{"url":"https://twitter.com/zachxbt","name":"twitter.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-08-26","event":"GRO token launches at approximately $19.66; Growth DeFi protocol goes live on Ethereum.","source":""},{"date":"2020-11-23","event":"Consensys Diligence begins V1 smart contract audit, completed December 11, 2020. Audit raises concerns about owner role permissions and DAO transition planning.","source":""},{"date":"2021-02-08","event":"Critical flashloan price oracle exploit drains approximately $1.3–1.4 million (~801 ETH) from the stkGRO/rAAVE staking contract. Attacker: 0x5e05bc89ae5f21b48500d9685526e0dab421a04b. No funds recovered.","source":""},{"date":"2021-02-09","event":"Growth DeFi team announces SAFE token airdrop compensation plan for affected stkGRO/rAAVE holders and announces migration from rAAVE to gROOT on BSC.","source":""},{"date":"2021-06","event":"Consensys Diligence completes second audit covering GrowthDeFi WHEAT protocol.","source":"","date_original":"2021-06-01"},{"date":"2021-09","event":"Growth DeFi integrates Chainlink price feeds on BSC for MOR stablecoin collateral pricing and liquidation processing.","source":"","date_original":"2021-09-01"},{"date":"2021-11-18","event":"CertiK delivers audit of the Growth DeFi MOR contract.","source":""},{"date":"2022-01-20","event":"Growth DeFi onboarded to CertiK security leaderboard; Skynet trust score not activated.","source":""},{"date":"2023-05-25","event":"Multiple price aggregators report last received price data for GRO token, indicating near-complete cessation of trading activity.","source":""},{"date":"2026-05-28","event":"Protocol TVL stands at approximately $22,249 (DefiLlama); GRO and xGRO tokens trade at near-zero valuations with negligible volume.","source":""}],"sources_used":[{"url":"https://growthdefi.medium.com/raave-farming-contract-exploit-explained-f3b6f0b3c1b3","name":"rAAVE Farming Contract Exploit Explained — Growth DeFi Medium","type":"official","archive_url":"http://web.archive.org/web/20251117130506/https://growthdefi.medium.com/raave-farming-contract-exploit-explained-f3b6f0b3c1b3","credibility":2,"archive_timestamp":"2025-11-17T13:05:06+00:00"},{"url":"https://smartcontractshacking.com/hacks/growth-defi-hack-2021","name":"Growth DeFi Hack (2021) — $1.4M Lost | Smart Contract Hacking","type":"research","archive_url":"https://web.archive.org/web/20260724212855/https://smartcontractshacking.com/hacks/growth-defi-hack-2021","credibility":2,"archive_timestamp":"2026-07-24T21:28:55+00:00"},{"url":"https://www.quadrigainitiative.com/casestudy/growthdefihack.php","name":"Feb 2021 - Growth DeFi Hack - $1.3m | Quadriga Initiative","type":"research","archive_url":"https://web.archive.org/web/20260724184713/https://www.quadrigainitiative.com/casestudy/growthdefihack.php","credibility":2,"archive_timestamp":"2026-07-24T18:47:13+00:00"},{"url":"https://defillama.com/protocol/growth-defi","name":"Growth DeFi — DefiLlama Protocol Page","type":"on_chain","archive_url":"http://web.archive.org/web/20250906142510/https://defillama.com/protocol/growth-defi","credibility":2,"archive_timestamp":"2025-09-06T14:25:10+00:00"},{"url":"https://consensys.net/diligence/audits/2020/12/growth-defi-v1/","name":"Growth DeFi V1 Audit — Consensys Diligence","type":"research","archive_url":null,"credibility":1,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://diligence.consensys.io/audits/2021/06/growthdefi-wheat/","name":"GrowthDeFi WHEAT Audit — Consensys Diligence","type":"research","archive_url":"http://web.archive.org/web/20250911064317/https://diligence.consensys.io/audits/2021/06/growthdefi-wheat/","credibility":1,"archive_timestamp":"2025-09-11T06:43:17+00:00"},{"url":"https://www.certik.com/projects/growthdefi","name":"Growth DeFi — CertiK Security Leaderboard","type":"research","archive_url":"https://web.archive.org/web/20260724181816/https://skynet.certik.com/projects/growthdefi","credibility":2,"archive_timestamp":"2026-07-24T18:18:16+00:00"},{"url":"https://www.crowdfundinsider.com/2021/09/180372-growth-defi-integrates-chainlink-price-feeds-to-support-lending-liquidation-other-services-for-mor-stablecoin-release/","name":"Growth DeFi Integrates Chainlink Price Feeds — Crowdfund Insider","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coinmarketcap.com/currencies/growthdefi/","name":"Growth DeFi GRO Token — CoinMarketCap","type":"other","archive_url":"http://web.archive.org/web/20250813131048/https://coinmarketcap.com/currencies/growthdefi/","credibility":2,"archive_timestamp":"2025-08-13T13:10:48+00:00"},{"url":"https://coinmarketcap.com/currencies/growthdefi-new/","name":"Growth DeFi xGRO Token — CoinMarketCap","type":"other","archive_url":"http://web.archive.org/web/20250911115442/https://coinmarketcap.com/currencies/growthdefi-new/","credibility":2,"archive_timestamp":"2025-09-11T11:54:42+00:00"},{"url":"https://brittanyd.medium.com/raave-to-groot-whats-next-for-growth-defi-bda76c7d9a6f","name":"rAAVE to gROOT: What's Next for Growth DeFi — Medium","type":"community_report","archive_url":"https://web.archive.org/web/20260724174719/https://brittanyd.medium.com/raave-to-groot-whats-next-for-growth-defi-bda76c7d9a6f","credibility":3,"archive_timestamp":"2026-07-24T17:47:19+00:00"},{"url":"https://growthdeficommunity.medium.com/growth-defi-community-recap-february-2021-f0ca4d9c9064","name":"Growth DeFi Community Recap February 2021 — Medium","type":"community_report","archive_url":"https://web.archive.org/web/20260726065737/https://growthdeficommunity.medium.com/growth-defi-community-recap-february-2021-f0ca4d9c9064","credibility":3,"archive_timestamp":"2026-07-26T06:57:37+00:00"},{"url":"https://coinbureau.com/review/growth-defi-gro/","name":"Growth Defi Review: GRO Worth It? — Coin Bureau","type":"news_article","archive_url":"http://web.archive.org/web/20260315141606/https://coinbureau.com/review/growth-defi-gro","credibility":2,"archive_timestamp":"2026-03-15T14:16:06+00:00"},{"url":"https://growthdefi.medium.com/the-future-of-raave-58be3063dfdb","name":"The Future of rAAVE — Growth DeFi Medium","type":"official","archive_url":"https://web.archive.org/web/20260726033431/https://growthdefi.medium.com/the-future-of-raave-58be3063dfdb","credibility":2,"archive_timestamp":"2026-07-26T03:34:31+00:00"},{"url":"https://growthdefi.medium.com/mor-capital-efficiency-for-bsc-a-novel-way-to-borrow-and-get-paid-for-doing-so-by-growth-20c97b542633","name":"MOR Capital Efficiency for BSC — Growth DeFi Medium","type":"official","archive_url":"https://web.archive.org/web/20260724212005/https://growthdefi.medium.com/mor-capital-efficiency-for-bsc-a-novel-way-to-borrow-and-get-paid-for-doing-so-by-growth-20c97b542633","credibility":2,"archive_timestamp":"2026-07-24T21:20:05+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:59.175149+00:00","updated_at":"2026-08-29T01:35:47.582+00:00"}}