On August 9, 2023 Earning.Farm (yield farming platform on Ethereum) was exploited for approximately $528,000-$540,000 via a reentrancy vulnerability in the withdraw() function where flawed share-burning logic allowed the attacker to reenter the contract and drain additional funds.

The DeFi project Earning.Farm suffered a reentrancy attack and lost 286 ETH (approximately $530,000). According to the analysis of SlowMist, the attacker re-enters the transfer function of LP to transfer LP tokens when withdrawing money, making the balance of the account smaller than the previously calculated shares value, triggering the logic of updating the shares value, resulting in the number of manipulated LPs being updated to the desired value. In terms of the value of the burned shares, this resulted in the final amount of LP burned being much smaller than expected, and the user can withdraw the funds in the pool by withdrawing the transferred LP again.