Reentrancy Flaw in Forked Beefy Vaults Drains $30 Million From Grim Finance

Grim Finance, a Fantom-based auto-compounding vault protocol forked from Beefy Finance, has become the 18th entry on rekt's leaderboard after losing roughly $30 million to a reentrancy exploit.

In its post-attack statement, the project described its own code as "advanced" — a characterization at odds with the fact that reentrancy bugs are a long-known, well-documented class of vulnerability. $GRIM's price dropped 80% in the aftermath.

Notably, Charge DeFi lost 1,849 $CHARGE to what appears to be the same attack vector just hours before the Grim Finance incident, raising the possibility that a single actor targeted both protocols in succession.

Credit: RugDoc

01The Vulnerability

The root cause was an unprotected depositFor() function that lacked reentrancy safeguards. Because the function let callers specify the deposit token themselves, the attacker was able to pass in a malicious contract as that token — one designed to re-enter the vault's deposit logic repeatedly within a single initial call, artificially inflating the attacker's share of the vault with each loop.

An example transaction illustrates the workflow, as documented by @k3mmio:

1. Take out a flashloan for two tokens (e.g., WBTC and FTM).
2. Supply that liquidity to SpiritSwap.
3. Receive SPIRIT LP tokens in return.
4. Call depositFor() on the GrimBoostVault contract with token set to the attacker's own malicious contract and user set to the attacker.
5. Use that contract's safeTransferFrom call as the re-entry point back into the vault.
6. Repeat step 4 recursively.
7. On the final loop, call depositFor() again, this time with token set to the genuine SPIRIT-LP token and user still the attacker.
8. Each level of recursion increases the amount of GB-XXX-YYY vault shares credited to the attacker.
9. The attacker ends up holding a vastly inflated balance of GB-XXX-YYY tokens.
10. Those shares are redeemed for an outsized amount of SPIRIT-LP tokens.
11. The LP position is unwound back into the two underlying tokens.
12. The flashloan is repaid, leaving the attacker with the surplus.

Attacker's address: 0xdefc385d7038f391eb0063c2f7c238cfb55b206c

Grim Finance says it is actively tracking the movement of the stolen funds across the attacker's accounts and has already identified links to several centralized exchanges. Additional updates are being shared in rekt.news' Telegram group.

02Aftermath

Charge DeFi says it contacted other projects running similar code to warn them about the vulnerability before it could be exploited further. Whether that outreach had its intended effect is unclear — one Discord user subsequently claimed responsibility for the attack.

If that claim holds up, it would mean at least a portion of the roughly $30 million taken is destined for charitable causes rather than the attacker's own pocket — cold comfort for the users who didn't choose to donate.