MYSTERYToken Rug Pull

What happened

MYSTERYToken was a yield-farming token on BNB Smart Chain, with a MasterChef farm that paid out MYSTERY rewards. De.Fi's REKT database lists it as an exit scam / rug pull dated 2021-08-26 and gives no loss figure. The verified source puts no cap on supply: any address holding the minter role can call mint for any amount, and the farm owner can set the reward rate to any value.

The farm also lets the owner raise a pool's deposit fee to 100%.

How it happened

1. At deployment the token mints its initial supply to the deployer, _mint(msg.sender, _initialSupply); with _initialSupply = 338001*10**18, and MinterRole's constructor makes the deployer a minter (_addMinter(msg.sender);).
2. mint has no cap: function mint(address _to, uint256 _amount) public onlyMinter { _mint(_to, _amount); ... }. A minter can add further minters with addMinter, so the supply that holders and the liquidity pool are priced against is not fixed. A minter can give up the role with renounceMinter(), but nothing in the code forces it.
3. The farm is how new tokens enter circulation. updatePool mints MYSTERY.mint(devaddr, MYSTERYReward.div(10)); and MYSTERY.mint(address(this), MYSTERYReward);, where the reward is multiplier.mul(MYSTERYPerBlock).mul(pool.allocPoint).div(totalAllocPoint). This only works if the farm has been given the minter role, which the supplied source does not show.
4. The reward rate is owner-controlled and unbounded: function updateEmissionRate(uint256 _MYSTERYPerBlock) public onlyOwner { massUpdatePools(); MYSTERYPerBlock = _MYSTERYPerBlock; }. A very high rate would make the next updatePool mint a correspondingly large amount, one tenth of it to devaddr, which could then be sold into the market.
5. Deposit fees are capped only at 100%: require(_depositFeeBP <= 10000, "set: invalid deposit fee basis points");. In deposit the fee goes to feeAddress (pool.lpToken.safeTransfer(feeAddress, depositFee);) and the depositor is credited user.amount.add(_amount).sub(depositFee), which is zero for the new deposit at 10000. Stakers who deposited before a fee change keep their recorded balance and can still call withdraw or emergencyWithdraw for it.
6. What happened: De.Fi's REKT database lists MYSTERY as an exit scam / rug pull dated 2021-08-26 with no funds-lost value. No transaction was opened showing a mint, an emission change or a fee change, so the steps above describe what the code allowed, not a confirmed sequence.

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract MYSTERY

Protocol links Website

Evidence

• address BscScan verified source, contract 0x7c89B9ee3adEa9FFb0A25A9f45E2e962B47cB931 bscscan.com
• analysis De.Fi REKT database listing for MYSTERY (proof link, BscScan token page) bscscan.com
• analysis Sourcify repository, chain 56, MasterChef repo.sourcify.dev