Ordinals Finance Rug Pull

Reported loss $1.0M
Rugpull

What happened

Ordinals Finance promoted a lending and staking protocol for Bitcoin Ordinals but launched its OFI token on Ethereum, at 0x419e35e3…0497dc, deployed on 19 February 2023 by 0x905BB314…fC7f6E. On 24 April 2023 CertiK reported an exit scam costing users about $1 million: according to Cointelegraph's account of CertiK's findings, the developer pulled 256 million OFI out of the OEB staking contract with a safuToken function and 13 million OFI out of the OFI staking contract with ownerRewithdraw, swapped them for ETH and consolidated the funds at 0x34eA9952…D25cCF. OFI fell about 94% within an hour, and the project deleted its website and social media accounts.

The token contract adds a 3% liquidity tax and a 3% treasury tax on pool trades. The ETH from the treasury tax and the LP tokens from automatic liquidity both go to treasuryWallet, initially the externally owned address 0x524570E6…fa058a; the owner can point it at any other address with the owner-only setTreasuryWallet(newWallet), and nothing locks the LP tokens it receives.

De.Fi's REKT database names the deployer as the scammer address and 0xa14AdAA4…591550 and 0x524570E6…fa058a as two related EOAs that drained the WETH/OFI Uniswap V2 pools, and says 551 ETH went to Tornado Cash (Cointelegraph reported over 85.5 ETH). The transactions the listing cites show:

  • 0xe513b843…85694c (listed as the deployer's liquidity removal): the deployer sells 16,283,982.9885 OFI into the OFI/WETH Uniswap V2 pool for 16.6159 WETH through the Uniswap Universal Router.
  • 0xaaabf697…d0775d: the treasury wallet 0x524570E6…fa058a calls removeLiquidityETHWithPermit on the Uniswap V2 router, burning OFI/WETH LP tokens and receiving 28,787,578.3284 OFI and 3.54948 WETH.
  • 0xc6b60395…6ae46b: 0x34eA9952…D25cCF deposits 100 ETH into the Tornado Cash router.

How it happened

  1. The OFI constructor mints 1,000,000,000 OFI (9 decimals) to the deployer, and treasuryWallet starts as 0x524570E6…fa058a; the owner can replace it with setTreasuryWallet(newWallet).
  2. On pool trades, _transfer keeps 3% for liquidity and 3% for the treasury. When enough accumulates, _addLiquidity calls addLiquidityETH(..., treasuryWallet, block.timestamp), so the new LP tokens are sent to that address, and treasury ETH is sent with payable(treasuryWallet).send(address(this).balance).
  3. Tokens staked by users sat in separate staking contracts. According to Cointelegraph, citing CertiK, the developer called safuToken on the OEB staking contract to remove 256 million OFI and ownerRewithdraw on the OFI staking contract to remove 13 million OFI.
  4. On 24 April 2023 the deployer sold 16,283,982.9885 OFI into the OFI/WETH pool for 16.6159 WETH (0xe513b843…85694c), and the treasury wallet removed pool liquidity with removeLiquidityETHWithPermit (0xaaabf697…d0775d).
  5. The proceeds were consolidated at 0x34eA9952…D25cCF, which CertiK named, and that address deposited 100 ETH into Tornado Cash (0xc6b60395…6ae46b). Users lost about $1 million, and OFI's market cap fell from about $2.3 million to about $143,000.
  6. The project then deleted its website and social media accounts.

Protocol details

Classification Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract OFI
Protocol links Website @ordinalsfinance

Evidence

Same attack technique

Browse all hacks →
Kickboxer Tate $33K lost GN $96K lost Void.Cash $34K lost fcdep $675K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes