Incident Overview
SyncDex Finance rugpulled by the deployer. The scammer stole around 442,470 $USD.
The SyncDex Finance project showed several red flags even before it was rugpulled. Comments were muted on Twitter, and words were added to ban lists on Telegram/Discord channels to prevent concerns about the project from being raised. Moreover, their contract did not allow for withdrawing pledged funds, which is always a warning sign.
The staking pool allowed only admins to withdraw funds while users' assets remained locked up permanently.
Eventually, the deployer pulled out around 442,470 $USD worth of liquidity and vanished into thin air. The official Twitter and website of the project went shut down.
Scammer Address:
https://bscscan.com/address/0x5aA713AE…7fE194
Funds currently on addresses below:
https://explorer.zksync.io/address/0xE4eDb277…00bCE8
https://explorer.zksync.io/address/0x80C67432…99bCF8
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to SyncDex, these are the critical security checks that could have prevented this incident (April 2023).
- Verify all logic paths related to Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialSources & References
Learn to Prevent the Next SyncDex
The SyncDex hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.