Ozone Finance Token Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

Ozone Finance was a PancakeSwap-style yield farm on BNB Chain whose MasterChef, deployed on 3 April 2021 at 0x23E794D2…CE6879 by 0x4024d56D…79d769, pays out the OZONE token. The contract lets the owner set any pool's deposit fee as high as 100%. At 100%, a new deposit goes entirely to the fee address and the depositor is credited nothing, so there is nothing to withdraw.

The owner can also set the OZONE emission rate to any value, and the deployer still owns the contract. De.Fi's REKT database lists Ozone Finance as an exit scam, but the transactions behind that listing could not be opened.

How it happened

  1. The constructor fixes feeAddress from its arguments; only the current feeAddress can change it through setFeeAddress.
  2. add and set are onlyOwner and accept any deposit fee up to 100%: require(_depositFeeBP <= 10000, "set: invalid deposit fee basis points"). set works on existing pools at any time.
  3. In deposit, the fee is sent straight to feeAddress and the user is credited only the rest: user.amount = user.amount.add(_amount).sub(depositFee). At 10000 basis points the credited amount is zero, so neither withdraw nor emergencyWithdraw returns anything. LP tokens that were already staked stay withdrawable.
  4. updateEmissionRate(uint256 _ozonePerBlock) is onlyOwner with no upper bound. Each updatePool then mints the new reward rate to the MasterChef plus 10% extra to devaddr, which can dilute OZONE holders at will.
  5. renounceOwnership exists, but the owner read on-chain is still the deployer, so these settings remain available.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract OZONE
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain Deerdefi Loss not disclosed BNB Chain Antisocial.finance Loss not disclosed BNB Chain Original.finance Loss not disclosed BNB Chain MYSTERYToken Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes