What happened
Glockswap was a yield farm on Polygon whose MasterChef, deployed on 10 June 2021 at 0x5512D416…323633, minted GLOCK as rewards. Its add and set functions accept any deposit fee up to 10000 basis points, so the owner can make a pool send up to 100% of each new deposit to the fee address. Funds already staked can still be pulled out with emergencyWithdraw, which charges no fee.
The owner can also swap in any referral contract, and normal deposits and withdrawals call it, so a contract that reverts would push stakers onto emergencyWithdraw. De.Fi's REKT database lists Glockswap as an exit scam dated 27 August 2021, but no transaction showing the fee being raised was found.
How it happened
- Users deposit LP or GLOCK into a pool through
deposit; if the pool'sdepositFeeBPis non-zero, that share goes straight tofeeAddressand only the rest is credited. - The owner can call
setwith_depositFeeBPas high as10000, so any later deposit into that pool can be sent entirely tofeeAddress, leaving the depositor with a zero balance. feeAddressstarts as the deployer, and only the current fee address can change it.- Balances credited before a fee change stay withdrawable, since
emergencyWithdrawreturnsuser.amountwith no fee.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
