Farmland Network Rug Pull

Reported loss $892
Ethereum
Rugpull

What happened

Farmland.Network (FRMN) was an ERC-20 token on Ethereum whose contract let its owner mint unlimited tokens to any address. The function is named initialLiquidityTokens, and its one-time guard checks a flag that no code ever sets, so it can be called again at any time. On 2020-12-07 the deployer added 30 ETH and 30,000 FRMN to a Uniswap V2 pool (tx 0x932dab5b…304afd), called initialLiquidityTokens at 11:59:44 UTC to mint to its own address (tx 0xc7c01bd0…5e501c; De.Fi's REKT database lists the amount as 99,999,999.9 tokens), and at 12:00:40 UTC swapped 100 million FRMN for 31.51 ETH on Uniswap V2 (tx 0x2f44fb03…a7baa3).

De.Fi's REKT database lists the incident as an exit scam / rug pull with an 892 USD loss.

How it happened

  1. The owner-only mint is function initialLiquidityTokens (address Contract, uint256 initialSupply) public onlyOwner { require(initialTokenGenerationFinish == false); _totalSupply = _totalSupply.add(initialSupply); _balances[Contract] = _balances[Contract].add(initialSupply); initialTokensGenerationFinish = true; }. It credits _balances[Contract] with any amount the owner chooses and raises _totalSupply to match.
  2. The guard never closes. The require reads initialTokenGenerationFinish (no 's' after Token), an internal variable (declared as bool initialTokenGenerationFinish; with no visibility keyword) set to false in the constructor and never assigned again. The function sets a different variable, initialTokensGenerationFinish, so the check passes on every call and the owner can mint repeatedly.
  3. The deployer 0x78Fc3329…49f6ea created the FRMN/WETH pool by calling addLiquidityETH with 30 ETH and 30,000 FRMN on 2020-12-07 at 11:43:51 UTC (tx 0x932dab5b…304afd).
  4. At 11:59:44 UTC the same address called initialLiquidityTokens on the token contract (tx 0xc7c01bd0…5e501c). Etherscan shows the call coming from the deployer and tokens credited to the deployer's own address. De.Fi's REKT database lists the minted amount as 99,999,999.9 tokens; the contract's current totalSupply() of 100,049,999.9 FRMN is consistent with that figure plus an earlier 50,000.
  5. At 12:00:40 UTC, 56 seconds after the mint, the deployer called swapExactTokensForETH on the Uniswap V2 router with 100 million FRMN and received 31.51 ETH (tx 0x2f44fb03…a7baa3). The minted supply was thousands of times the 30,000 FRMN in the pool, so the swap drained nearly all the pool's ETH side. De.Fi's listing describes this transaction as liquidity removal, but Etherscan labels it as a token swap.
  6. The contract also inherits renounceOwnership() and transferOwnership() from Ownable, so the owner could have given up the mint power; no opened transaction shows that it did.

Protocol details

Classification Yield Aggregator
Protocol Type Exit Scam/Rugpull
Affected asset / contract FRMN
Protocol links Website @FarmlandNtwrk

Evidence

Same attack technique

Browse all hacks →
Ethereum TRBAS3 $3K lost Ethereum DEFIBase $379K lost Ethereum Pump Farm $478K lost Ethereum Waronrug degen token $555 lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes