Hippolygon Rug Pull

Reported loss Not disclosed
Polygon
Rugpull

What happened

De.Fi's REKT database lists Hippolygon (HIPPO) as an exit scam / rug pull dated 2021-08-30 on Polygon, with no loss amount. The verified contract at 0xA6226c90…34F1a9 (deployed 2021-06-29 UTC by 0x711F6A1E…9c7439) is a MasterChef farm that takes LP-token stakes and pays HIPPO rewards. Its owner can set a pool's deposit fee as high as 100% and can raise the reward emission without a cap, while the HIPPO token has no supply limit.

Withdrawals have no pause or lock in this source. The code shows what the owner can do; no transaction opened for this record shows it was done.

How it happened

  1. The owner creates pools with add and edits them with set. Both accept the deposit fee require(_depositFeeBP <= 10000, "set: invalid deposit fee basis points");, and 10000 basis points is 100%. set works on a pool that already has stakers.
  2. In deposit, the staker is debited first: pool.lpToken.safeTransferFrom(address(msg.sender), address(this), _amount);. Then the fee is taken: uint256 depositFee = _amount.mul(pool.depositFeeBP).div(10000);, pool.lpToken.safeTransfer(feeAddress, depositFee); and user.amount = user.amount.add(_amount).sub(depositFee);. At 10000, depositFee equals _amount, the whole deposit goes to feeAddress, and the staker is credited 0.
  3. feeAddress is fixed by the constructor and can only be changed by itself: function setFeeAddress(address _feeAddress) public { require(msg.sender == feeAddress, "setFeeAddress: FORBIDDEN");. The source does not say who holds it.
  4. Emission has no cap: function updateEmissionRate(uint256 _HIPPOPerBlock) public onlyOwner sets any value, and updatePool mints HIPPO.mint(devaddr, HIPPOReward.div(10)); and HIPPO.mint(address(this), HIPPOReward);. The token's function mint(address _to, uint256 _amount) public onlyOwner has no maximum supply, so a very large emission can dilute every HIPPO holder.
  5. Exits are not gated: withdraw and emergencyWithdraw both end in pool.lpToken.safeTransfer(address(msg.sender), ...) with no pause. The fee path takes funds at deposit time, not at exit. The source does not show whether the fee was raised or the emission changed.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract HIPPO
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain PuffinSwap Loss not disclosed BNB Chain CatgeSwap Loss not disclosed BNB Chain Jester DeFi Loss not disclosed BNB Chain Haikyu Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes