Polyfox.finance Rug Pull

What happened

Polyfox.finance was a yield-farming project on Polygon: a MasterChef staking contract that paid out the FOX token ("PolyFox Token"). De.Fi's REKT database lists FOX as an exit scam / rug pull dated 2021-08-26 and gives no loss figure. The verified farm contract has no function that lets the owner pull staked tokens out directly.

Its weak point is the deposit fee: the owner can set any pool's depositFeeBP as high as 10000 (100%) with no delay, so new deposits can be sent in full to feeAddress while the depositor is credited with nothing.

How it happened

1. The MasterChef constructor makes the deployer the owner and sets both recipients: devAddress = msg.sender; and feeAddress = msg.sender;. Only the current feeAddress can reassign the fee recipient (setFeeAddress requires msg.sender == feeAddress).
2. The owner can create or edit pools with add(...) or set(...). The only limit on the fee is require(_depositFeeBP <= 10000, "set: invalid deposit fee basis points");, so a 100% fee is allowed, and set applies to a live pool immediately.
3. In deposit, the LP tokens are first pulled from the user (pool.lpToken.safeTransferFrom(address(msg.sender), address(this), _amount);), then the fee is computed and sent out: uint256 depositFee = _amount.mul(pool.depositFeeBP).div(10000); pool.lpToken.safeTransfer(feeAddress, depositFee);.
4. The depositor is credited user.amount = user.amount.add(_amount).sub(depositFee);. With depositFeeBP == 10000 the fee equals the deposit, so that deposit is credited as zero and withdraw (require(user.amount >= _amount, "withdraw: not good");) cannot return it. Stakers who deposited earlier keep their recorded user.amount and can still use withdraw or emergencyWithdraw.
5. Rewards are also owner-steerable. set can drop a pool's allocPoint to 0, and updatePool mints an extra tenth of every reward to the dev address: fox.mint(devAddress, foxReward.div(10));. FoxToken.mint is onlyOwner, so this works only while the farm is the token's owner, which the supplied source does not show.
6. What happened: De.Fi's REKT database lists FOX as an exit scam / rug pull dated 2021-08-26 with no funds-lost value. No transaction was opened showing a 100% fee being set or fees being collected, so the steps above describe what the code allowed, not a confirmed sequence.

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract FOX

Protocol links Website @polyfoxfi

Evidence

• address Polygonscan verified source, contract 0x159AAd97c625C7eAC5ddDDbC088c639490b9c55a polygonscan.com
• analysis De.Fi REKT database listing for FOX (proof link, Polygonscan token page) polygonscan.com
• analysis Sourcify repository, chain 137, MasterChef repo.sourcify.dev