Guru protocol shutting down after an exploit on July 24th; Defimon detected the attack but communication delays prevented timely pause.
Security & Exploits ·
Guru Fund Lotus announced on July 28th that it is shutting down following an exploit on July 24th that extracted approximately $101,296.64 from its Ethereum Mainnet deployments. The vulnerability lay not in the vault contracts themselves, but in a legacy peer-to-peer trading adapter that remained enabled despite being designed only for testing. The adapter's approveForP2P function accepted three security-sensitive parameters directly from transaction data with no validation—allowing an attacker to grant arbitrary token allowances from the fund's vaults to any contract address.
The exploit was possible because the adapter, originally created to facilitate private token exchanges between Gurus and trusted counterparties, was never properly verified or restricted when it became part of the live protocol. The controller that governs vault operations only checked whether an adapter address was authorized at the protocol level, without validating the specific calls made through it. This meant deposit transactions could invoke the vulnerable adapter under the assumption they would only perform legitimate swaps.
A detection service identified the attack before significant additional loss occurred, but a communications delay prevented the protocol team from pausing operations in time to stop the initial exploit. The exact timeline of the discovery and the team's response window remain unspecified. The full incident report details the vulnerable code and operational failures that enabled the attack.