Reaper Farm hack: SmartState overview

Key omissions which created the vulnerability

  1. Failure to perform the usual internal security audit after making changes;
  2. Lack of external smart contract audits;
  3. Lack of communication with the white-hat community, even though Reaper Farm had previously established a $200K bounty for bug finding.

Hack implementation

  1. User 0x5636e55e4a72299a0f194c001841e2ce75bb527a exploited the multi-strategies’ lack of validation and drained user funds into their wallet. This was done in a rapid series of transactions on the Fantom network, most notable being
  2. This user’s funds were bridged from Binance Smart Chain using O3 Network’s cross-chain swap router. They received the BNB for this swap from Tornado cash, and marks it as 100% anonymous.
  3. After the attack, the hacker bridged the funds to Ethereum to the following address: 0x2a038e100f8b85df21e4d44121bdbfe0c288a869. The funds were promptly sent to Tornado Cash for laundering.




Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store


SmartState is an independent audit company for DLT projects. It performs smart contract audit and security reviews and provides reco for improvements.