BoobsDefi Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

This is the yield-farming contract for the BOOBS token on BNB Smart Chain. Stakers deposit LP tokens into MasterChef and receive BOOBS rewards. Its setMigrator function (owner only) can point the farm at any contract, and migrate(uint256 _pid) (callable by anyone) then approves that contract for the farm's entire LP balance and accepts whatever token it returns, as long as the farm's balance of the new token equals the old balance.

A malicious migrator could take the LP tokens and hand back a worthless token, leaving stakers' deposits unbacked. The deposit fee is also owner-adjustable up to 100% per pool. De.Fi's REKT database lists the project as an exit scam / rug pull dated 2021-08-25 with no loss figure; the code shows what the owner can do, not what the owner did.

How it happened

  1. Users call deposit(_pid, _amount), and MasterChef holds their LP tokens while userInfo records each balance.
  2. The owner calls setMigrator(IMigratorChef _migrator) public onlyOwner, which stores any address as migrator with no timelock or limit. The owner read on 2026-09-30 is 0x6e3c7b74…465b15, the same address as the deployer.
  3. migrate(uint256 _pid) is public with no access check. It reads uint256 bal = lpToken.balanceOf(address(this));, runs lpToken.safeApprove(address(migrator), bal); and calls migrator.migrate(lpToken), so the migrator receives an allowance over every staked LP token in that pool and can move them with transferFrom.
  4. The only guard is require(bal == newLpToken.balanceOf(address(this)), "migrate: bad");. A migrator that returns a token it controls and credits to the farm with the same balance passes this check, after which pool.lpToken = newLpToken replaces the real LP token.
  5. After that, withdraw and emergencyWithdraw pay stakers through pool.lpToken.safeTransfer(...) from the replacement token, not from the original LP tokens. This is what the code allows; no transaction showing a migrator being set was opened.
  6. A second control is set(...) public onlyOwner, which accepts _depositFeeBP up to 10000 (100%); deposit then computes depositFee = _amount.mul(pool.depositFeeBP).div(10000) and sends it to feeAddress.
  7. The reward token also carries a hard-coded 20% cut: BoobsToken.mint sends _amount * 1/5 to devAddress 0x6e3c7B74…465B15 and only _amount * 4/5 to the recipient, while updatePool credits stakers on the full reward (accEggPerShare uses boobsReward), so the farm is minted less than it accounts for and safeEggTransfer pays out only up to its balance.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract BoobsDefi
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain Kingdomswap Loss not disclosed BNB Chain Pablo Escobar Loss not disclosed BNB Chain Rick.finance Loss not disclosed Rimau Finance Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes