Haikyu Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

Haikyu (KYU) was a yield farm on BNB Chain, launched on 17 May 2021 with the KYU token at 0x4f578470…414d18 and a MasterChef staking contract at 0x3C37a717…94A6De. The token burns 2% of every transfer and has no blacklist or sell block. The farm's owner, still the deployer 0x220182F6…8E42De, can set any pool's deposit fee as high as 100% through add and set, so new deposits can be sent in full to the fee address.

The owner can also add pools for any token with any share of emissions, and every reward mints an extra 10% to the dev address. Tokens already staked stay withdrawable through emergencyWithdraw, and the farm has no migrator or owner withdrawal function. De.Fi's REKT database lists Haikyu as an exit scam/rug pull; no opened source shows what happened.

How it happened

  1. add and set are onlyOwner and accept any fee up to the whole deposit: require(_depositFeeBP <= 10000, "set: invalid deposit fee basis points");.
  2. In deposit, depositFee = _amount.mul(pool.depositFeeBP).div(10000) is sent to feeAddress and only the remainder is credited to the user. At 10000 basis points a new deposit is credited as zero and the whole amount goes to feeAddress, which the constructor sets to the deployer.
  3. add accepts any _lpToken and _allocPoint, so the owner can open a pool for a token only it holds and direct most new KYU emissions to itself, then sell the KYU. updatePool also mints haikyuReward.div(10) extra to devAddress on every update.
  4. Stakes deposited before a fee change are not charged: emergencyWithdraw returns user.amount of the pool's token, and no function lets the owner move staked tokens.

Protocol details

Classification NFT
Protocol Type Exit Scam/Rugpull
Affected asset / contract KYU
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Polygon Hippolygon Loss not disclosed BNB Chain Jester DeFi Loss not disclosed Polygon Glockswap Loss not disclosed BNB Chain Evilswap Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes