VIVAToken Rug Pull

Reported loss Not disclosed
Rugpull

What happened

VIVAToken was a BNB Chain yield farm whose MasterChef contract, deployed on 14 July 2021 at 0xD9D4467F…9f06e1, took LP-token deposits and paid rewards in VIVA. Next to the usual deposit and withdraw code it has an owner-only updateMasterchef function, commented as a V2 migration, that sends the contract's entire balance of any listed token, including every user's staked LP tokens, to an address the owner chooses. Nothing in the function records who owned those tokens, so after it runs the farm still shows each user's stake but holds nothing to pay it back.

The deployer 0x2AC11a63…abC0Cd still holds ownership. De.Fi's REKT database lists VIVA as an exit scam/rug pull; no loss figure was found.

How it happened

  1. Users call deposit, which pulls LP tokens into the farm with pool.lpToken.safeTransferFrom(address(msg.sender), address(this), _amount) and records the stake in user.amount.
  2. The owner calls updateMasterchef(maincontract, router) with the LP token addresses in maincontract and any destination in router.
  3. For each token the function reads tokenObj.balanceOf(address(this)) and runs tokenObj.transfer(router, tokenAmt), moving the farm's whole balance, staked LP included, to that address.
  4. userInfo is not changed, so withdraw and emergencyWithdraw try to send each user's recorded user.amount from a zero balance and revert; the LP tokens can then be redeemed for the pool's underlying tokens by whoever received them.
  5. The owner can also raise VIVAPerBlock without limit through updateEmissionRate; every reward update mints another 10% of the pool reward to the two dev addresses (750 and 250 basis points).

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract VIVA
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain Rick.finance Loss not disclosed Rimau Finance Loss not disclosed Elongate Deluxe $230K lost Photon-Swap Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes