On 8 February 2021 an attacker created a worthless rAXZZ token and a GRO/rAXZZ Uniswap pool, then used the single-asset deposit feature of Growth DeFi's stkGRO/rAAVE farming contract which failed to validate LP token identity, accepting the GRO/rAXZZ LP shares as legitimate GRO/rAAVE LP shares, allowing the attacker to mint 14,513 stkGRO/rAAVE shares and drain the pool.