Incident Overview
Play-to-earn game Dragoma was rug pulled by its team, for $3,500,000 $USD.
Dragoma is an application with built-in GameFi and SocialFi elements. In the game, users were invited to form dragon training teams and receive rewards for their breeding, training, and competitions.
The project team drained the funds of its investors and withdrew the funds to a centralized exchange. The initial token holder EOA drained the pools after receiving 38,000,000 $DMA tokens from the project's vault contract with unverified source code. The token transfer transaction was initiated by the token deployer. As soon as they closed the project without announcing their community, they doubled the suspicion that the project is a scam by deleting their website, as well as all social networks. As the news about the scam spread among the community, the price of the token itself also collapsed, falling to 99%.
Attacker address:
https://polygonscan.com/address/0x4c0ce1c7…db595d
Vault contract:
https://polygonscan.com/address/0xcec6540b…cb3929
Token transfer transaction:
https://polygonscan.com/tx/0x70ce1369…7129d2
Drain transaction example:
https://polygonscan.com/tx/0x7bbe8cc7…348c30
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Dragoma, these are the critical security checks that could have prevented this incident (August 2022).
- Verify all logic paths related to Drain Vaults / Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSecurity Audit History
- Soken Report
Sources & References
Learn to Prevent the Next Dragoma
The Dragoma hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.