What happened
Beets Farm (BeetsFarm Finance) was a Polygon yield farm whose MasterChef, deployed on 14 June 2021 at 0x56961056…8E97c7 by 0x369CaBe5…aC1a1A, paid rewards in BeetCoin (BEET). Its deposit and emergencyWithdraw functions take a _wallet argument instead of using the caller, so anyone can pull tokens from any address that approved the farm, and emergencyWithdraw sends a user's whole stake to the admin wallet rather than back to the user. Reports published on 18 June 2021, crediting RugDoc's analysis, say the operators forced approved accounts to deposit their remaining tokens and then emergency-withdrew everything to their own wallet.
The Quadriga Initiative puts the loss at about $146,000 across 289 users; another report gives more than $100,000. The contract source was not verified on the explorer at the time of the rug.
How it happened
- The constructor stores
walletandfeeWallet; both were set to the deployer 0x369CaBe5…aC1a1A. Only the currentwalletcan change it (require(msg.sender == wallet, "dev: wut?")). deposit(uint256 _pid, uint256 _amount, address _wallet)has no check thatmsg.senderis_wallet, and pulls the tokens withpool.lpToken.safeTransferFrom(address(_wallet), address(this), _amount). Anyone can therefore move tokens into the farm from any address that has approved the MasterChef, up to the approved amount.getAllHolderslists every address that ever deposited into a pool, which gives a ready list of targets.emergencyWithdraw(uint256 _pid, address _wallet)is also callable by anyone for any user. It zeroes the user's stake and runspool.lpToken.safeTransfer(address(wallet), amount), so the tokens go to the adminwallet, not to the user.- According to the June 2021 reports, the operators combined steps 2 and 4: they forced approved accounts to deposit their remaining tokens and then emergency-withdrew all stakes to the admin wallet.
Protocol details
Evidence
- transaction Beets Farm MasterChef creation transaction polygonscan.com
- address Beets Farm MasterChef verified source code on Polygonscan polygonscan.com
- analysis Beets.Finance (Beets) token on Etherscan (record link and De.Fi proof) etherscan.io
- analysis Sourcify match for 0x569610567F5262b6A9bfdf6B04793A407d8E97c7 on Polygon repo.sourcify.dev
- analysis Jun 2021 - BeetsFarm Finance Exit Scam - $146k (Global) quadrigainitiative.com
- analysis Beets Finance rug pull details, more than 100,000 dollars stolen cryptocoindaddy.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
