Rimau Finance Rug Pull

These steps describe what the code allows, not a recorded sequence of transactions.

1. Users stake LP tokens with deposit(_pid, _amount), which runs pool.lpToken.safeTransferFrom(address(msg.sender), address(this), _amount); and credits user.amount. The LP tokens sit in the MasterChef contract.
2. The owner can call setMigrator(IMigratorChef _migrator), which is onlyOwner and does migrator = _migrator; with no validation of the target.
3. Anyone can then call migrate(_pid). It reads uint256 bal = lpToken.balanceOf(address(this));, grants the migrator an allowance of everything with lpToken.safeApprove(address(migrator), bal); and calls IBEP20 newLpToken = migrator.migrate(lpToken);.
4. The migrator is external code, so it can pull the approved LP tokens out of the farm. The only guard is require(bal == newLpToken.balanceOf(address(this)), "migrate: bad");, which trusts the balance reported by whatever token the migrator returns. The pool is then re-pointed with pool.lpToken = newLpToken;, and later withdraw and emergencyWithdraw calls pay out of that token instead of the original LP.
5. Separately, updateMultiplier(uint256 multiplierNumber) sets BONUS_MULTIPLIER = multiplierNumber; with no cap, and updatePool() mints cake.mint(devaddr, cakeReward.div(10)); plus cake.mint(address(syrup), cakeReward); scaled by it.
6. The owner role can be given up with renounceOwnership(). The contract owner reads as 0x00000000…000000 in an eth_call on 2026-09-30 (current state, not historical), so setMigrator and updateMultiplier are no longer callable today. If a migrator was set before that, migrate stays callable by anyone.