SynLev Rug Pull

The removeLiquidity() function makes a call of the external function getSharePrice() in vaultHelper contract:

Address 0xe0d6…00f2

vaultHelper is a proxy contract with EOA owner - 0xa2e316cb…5c83c4

The owner could set any address as price aggregator in vaultHelper calling proposeVaultPriceAggregator()

A new aggregator (unverified contract) was provided in the transaction:

Tx 0xc888…07a6

This hidden aggregator set the share price to 0.

After this, the contract deployer easily withdrew all vault balance with zero share price which can be found in the event log: Tx 0x216d…0951

The contract deployer added liquidity into the contracts multiple times:

Source

Source

The contract deployer invoked the removeLiquidity() function into the vault contract to withdraw 541.27 and 20.41 ETH onto his wallet at:

Tx 0x216d…0951

Tx 0x5131…fce4

The contract deployer invoked the ethremove() function into the synSales contract to withdraw 152.09 ETH onto his wallet at:

Tx 0xec4b…602d

The contract deployer invoked the removeLiquidity() function into the other vault contract to withdraw 104.41 ETH onto his wallet at:

Tx 0x6afe…9d8d

The contract deployer invoked the removeLiquidity() function into the other vault contract to withdraw 10.59 ETH onto his wallet at:

Tx 0x5c76…4e51

The contract deployer invoked the removeLiquidity() function into the other vault contract to withdraw 24.26 ETH onto his wallet at:

Tx 0xe4c8…0397