Incident Overview
The development team has abandoned the project.
Their announcement:
"We're sorry to announce but due to continued down pressure of the raven and scare token, dotcom twitter fud campaign and continued fud by both investors and non investors in the group and the vault issues, Raven will continue as is until it hits its supply of 160k tokens. we will not be making another layer.
We will not be developing the ScareCrow Finance project any further. The websites will be live until all tokens have been distributed as rewards.
If you need to use the contracts to withdraw at a later date, please use ftmscan to interact with the masterchef and withdraw your funds. Instructions to do so can be found through research online."
The conclusion of the on-chain analysis did not show a fact of scam on the part of the team.
Incident Report
Protocol Information
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to ScareCrow, these are the critical security checks that could have prevented this incident (December 2021).
- Verify all logic paths related to Abandoned are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
-
01
Source 1 https://t.me/scarecrowfinance/109844
Learn to Prevent the Next ScareCrow
The ScareCrow hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.