Pablo Escobar Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

Pablo Escobar was a BNB Chain yield farm whose MasterChefV2 contract, deployed on 10 March 2021 at 0x558d9E1B…f55813, took LP-token deposits and paid rewards in the Escobar Token (ESCO). The owner can set any pool's deposit fee as high as 100% (_depositFeeBP <= 10000), so after the change every new deposit is sent to the fee address and the depositor is credited nothing; the owner can also raise the ESCO emission rate without limit, and every reward update mints an extra 10% to the dev address. There is no migrator, and withdraw and emergencyWithdraw return LP tokens already staked.

The deployer 0xFF918899…9dD16b still holds ownership. De.Fi's REKT database lists the project as an exit scam/rug pull; no loss figure was found.

How it happened

  1. The owner calls set(_pid, _allocPoint, _depositFeeBP, _withUpdate), which only checks _depositFeeBP <= 10000, so the fee can be 10,000 basis points (100%).
  2. On deposit, the contract pulls the full _amount of LP tokens from the user, sends _amount * depositFeeBP / 10000 to feeAddress, and credits user.amount with the rest. At 100% the user's stake is zero and the whole deposit sits at feeAddress, an address the dev address can change with setFeeAddress.
  3. Separately, updateEmissionRate(_ESCOPerBlock) is owner-only with no upper bound. Each updatePool then runs ESCO.mint(devaddr, ESCOReward.div(10)) next to the pool rewards, so a higher rate mints more ESCO to the dev address, which can be sold into ESCO's liquidity.
  4. Staked LP already in the farm is not trapped by these functions: withdraw and emergencyWithdraw send user.amount back, and the contract has no migrator.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ESCOBAR
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain Mummy Token Loss not disclosed BNB Chain Kingdomswap Loss not disclosed BNB Chain BoobsDefi Loss not disclosed BNB Chain Rick.finance Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes