Pump Farm Rug Pull

Reported loss $478K
Ethereum
Rugpull

What happened

On 2020-12-05, within about 17 minutes, the Pump Farm deployer address 0xd084548b…7AB49a used admin functions of the farm contract 0x8f9A8Dc6…07C879, which owns the PPF token. It first called setMigrator (transaction 0xcacef01f…b30864, 21:20:15 UTC). Address 0x13a49838…e91fa7 then called migrate on the farm (for example 0x88e788af…42c164, 21:27:05 UTC) and received Uniswap V2 LP tokens from it; De.Fi's listing describes this as a third-party unverified contract that held an infinite approval over users' approved tokens.

The same address then removed the liquidity in transaction 0xeb99cfe7…5d3bfe (21:34 UTC), burning 10,977.34 LP tokens and receiving 279,706.15 PPF and 438.24 WETH. At 21:35:11 UTC the deployer called executeTransaction on the farm in transaction 0xa7ca31db…699d77, which minted new PPF from the zero address to 0xC1acF8C5…ECA08D (De.Fi lists the amount as 10q PPF), and at 21:36:53 UTC that address swapped 1 billion PPF for 220.604 ETH on Uniswap V2 (transaction 0x6d455a00…02c483). De.Fi lists the losses as 477,544 USD and says the funds were then moved through Tornado Cash in 8 transactions from address 0x0ef1a03c…fe1eaa.

How it happened

  1. The PPF token (FarmToken) is an Ownable ERC-20 whose only supply path after the constructor is function mint(address _to, uint256 _amount) public onlyOwner, with the comment "Must only be called by the owner (Farm)". Whoever controls the owner can create any amount of PPF.
  2. The owner is the farm contract 0x8f9A8Dc6…07C879. Etherscan shows the deployer calling setMigrator(address _migrator) and executeTransaction(address target, bytes data) on it, so the deployer had admin control of the farm and, through it, of the token's mint.
  3. A migrator in a MasterChef-style farm can pull the pool's LP tokens out of the farm via migrate. On 2020-12-05 the deployer called setMigrator, and 0x13a49838…e91fa7 then called migrate(uint256 _pid), receiving UNI-V2 tokens held by the farm.
  4. That address removed liquidity from the PPF/ETH pool with removeLiquidityETHWithPermit, receiving 279,706.15 PPF and 438.24 WETH for 10,977.34 LP tokens, which removed 438.24 WETH from the pool.
  5. The deployer then used executeTransaction on the farm to call the token's mint, minting new PPF from the zero address to 0xC1acF8C5…ECA08D, which swapped 1 billion PPF for 220.604 ETH in one Uniswap V2 swap.
  6. De.Fi's listing records the losses as 477,544 USD and states the proceeds went into Tornado Cash.

Protocol details

Classification Yield Aggregator
Protocol Type Exit Scam/Rugpull
Affected asset / contract PPF
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Ethereum DEFIBase $379K lost Ethereum Farmland Network $892 lost Ethereum Waronrug degen token $555 lost Ethereum Twerk Finance $13K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes