PolyWeed Rug Pull

What happened

PolyWeed was a Polygon yield farm whose MasterChef, deployed on 3 June 2021 at 0x703418a7…9d96D3 by 0x0d62e10b…409f65, paid rewards in PolyWeed Token (WEED). Each pool has an owner-set unstaking fee with no upper limit, and the contract has no emergencyWithdraw, so withdraw is the only way to get staked tokens back. By raising the fee the owner can send most or all of every withdrawal to the fee address, which the deployer controlled.

On 5 June 2021 RugDoc reported that the developers had set withdrawal fees to 98%, so stakers could get back at most 2% of their funds. The Quadriga Initiative estimates the loss at about $223,000.

How it happened

1. The constructor sets devaddr and feeAddress; both were the deployer 0x0d62e10b…409f65. Only the current feeAddress can change it. transferOwnership checks a private _control address that is set once to the deployer, so the deployer can always reclaim ownership.
2. add and set are onlyOwner. They cap the deposit fee at 100% (require(_depositFeeBP <= 10000, ...)) but never check _unstakingFeeBP, and set can change it on an existing pool at any time.
3. In withdraw, the fee is taken from the amount being withdrawn: pool.lpToken.safeTransfer(feeAddress, unstakingFee), the user's stake is reduced by the full _amount, and only sendAmount = _amount.sub(unstakingFee) reaches the user. At 9800 basis points a user gets back 2%; at 10000 they get nothing; above 10000 the subtraction reverts and withdrawals fail entirely.
4. The contract has no emergencyWithdraw, so a staker has no path around the fee.
5. By 5 June 2021, two days after deployment, RugDoc reported that the withdrawal fee had been set to 98% and that emergency withdraw was not available. The Quadriga Initiative puts the trapped funds at about $223,000.

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract WEED

Protocol links Website

Evidence

• report Report polygonscan.com
• report RugDoc (@RugSteemer) update: PolyWeed developers set withdrawal fees to 98% twitter.com
• transaction PolyWeed MasterChef creation transaction polygonscan.com
• address PolyWeed MasterChef verified source code on Polygonscan polygonscan.com
• analysis Sourcify match for 0x703418a72FC982ec157b6388E6e9f2C9E09d96D3 on Polygon repo.sourcify.dev
• analysis Jun 2021 - PolyWeed Withdrawal Fee Rug Pull - $223k (Global) quadrigainitiative.com
• analysis Sourcify match for WeedToken 0x3b00E8EB40fbF935088729a5967C22698F5Da117 on Polygon repo.sourcify.dev