QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
UNKNOWN
JUNE 2021
GLOBAL
GARUDA SWAP
DESCRIPTION OF EVENTS
"GarudaSwap.Finance is a brand new, audited, next generation yield farm on BSC." "GarudaSwap is the 1st Next Generation Yield Farm with Automatic Liquidity Reflection on #BSC with lots of unique and creative features."
"Highlighted features of GarudaSwap are Innovative tokenomics, Anti whale, Harvest lock-up to prevent token dumping, migrator code removed and 3% referral programme."
"GarudaSwap.finance aim to be long live project, with low initial supply, Automatic Liquidity with 8% reflection tax, and safe to user as audited by Techrate and Certik (processing)."
"When users put their tokens into liquidity pools and stake their LP tokens in a farm, they put their crypto tokens in a bank. But this time the bank is a protocol created by someone anonymous. Especially users that move between the high-APY yield farms are at risk."
On "June 16th, multiple farms their native tokens were exploited all the way to $0.00. KetchupSwap, Lokum, YBear, Piggy, CaramelSwap. Sadly enough GoCerberus and Garuda were exploited as well." "A major exploit has affected multiple BSC farms by driving their native token prices to 0." "Cerberus, Garuda, KetchupSwap, Piggy, CaramelSwap, and a few more projects got exploited at the same time, because of mishandling of tokens with transfer tax."
"Most of the yield farms use a trusted contract called a MasterChef, which is used even by PancakeSwap themselves to distribute rewards. The problem is that the MasterChef was never designed for all these special tokens, it was designed specifically to receive rewards for LP tokens."
"But, yield farms kept popping up and adding non-LP tokens and everything was fine. Until recently tokens with a transfer fee became more popular. Most of our tokens have a transfer fee as well, it’s how we can have our tokenomics. But the problem is that the MasterChef was not designed for this."
"Due to the design of the masterchef if you stake 100 tokens (with a 5% transaction fee) in a MasterChef, you are still able to withdraw 100 tokens from the MasterChef. But due to the transfer fee, only 95 tokens actually arrived in the contract."
"This wasn’t such an issue, none of the non-native tokens have a transaction fee… Except for the Garuda token. Earlier today we noticed that the Garuda pool balance was getting smaller and some users reported that they could no longer withdraw. We had disabled depositing to this pool and started to think about a compensation plan. We understood that the issue had to do with the transaction fees at this time but did not know that this could be further exploited."
"Due to the inner workings of the Masterchef, once user balances grow larger then the total token balance in the pool, they effectively get a multiplier on their rewards. Anyone that was still in the Garuda pool was getting way larger harvests then they should. Until the point came that so much Garuda was withdrawn from the Garuda pool, that this multiplier became so large that a single harvest harvested all GoCerberus in the masterchef, about 40 million tokens (worth $190k at the time)."
"In the masterchef, the rewards per staked token are actually calculated by dividing the pool emissions by the total tokens in the contract." "[I]f there is 1 token remaining in the masterchef, the rewards per token are equal to the total emissions of that pool. So what happens in our previous case when there may only be 0.001 token in the pool and users still have a balance of thousands of tokens? Their harvests are thousands of times larger then what they should be."
"We believed that once the MasterChef was out of tokens, there were no more coins to steal. The issue lies with the referral systems of the MasterChef. When you do a simple harvest, the reward is transferred from the MasterChef to you, so you cannot take more tokens than the tokens present in the MasterChef, this is because we have a function safeCerberusTransfer that does not allow to return more." "But, the referral system of the MasterChef sadly enough does not use safeCerberusTransfer. Instead, it mints tokens directly to the referral."
"[W]e believe someone figured this out and was able to mint an unimaginable large amount of tokens to their referral, all because of the transaction fee on one single pool, the Garuda pool… The whole MasterChef was secure but it relied on the assumption that the total tokens in the contract would always be equal to the total sum of deposits. An assumption which many protocols did not know about. Today, many of these protocols, including ourselves, got exploited."
"After discussing with our engineers, we thought about a method to ‘whitehat’ these funds and had actually started developing and deploying the contracts for this (essentially they would use the referral method above to mint a large amount of tokens). Although we believed we would have been able to secure these funds given a bit more time, we were not able to deploy and execute the whitehat contract our devs developed within time and at some point we were informed that it was ‘too late’. A very stressful call where everyone on the team was doing everything they could became silent. We did what we could. Sadly enough so many other projects today were vulnerable to the same exploit. It is a novel exploit and nobody was ready for it. We did our absolute best to salvage the remaining funds."
"The exact value that hackers stole is still unclear. However, hackers may have gotten away with an amount equal to the market cap of these projects."
"Because of BlockChain technology, our developers are able to make a snapshot of everybody’s balances right before the exploit. In the upcoming days, we will work out a detailed compensation plan for everybody that was holding Cerberus or Garuda either in an LP token, in their wallet or staking it to earn yield. But basically it will work like this."
"We will identify a block number before the first exploit and take a snapshot. We will identify the holder list of Cerberus, Garuda at that block ( either in LP pair, in LP pool, in single pool, in wallet). We will use web3 technology to calculate the number of their holding. We will make a web tool so each user can enter a wallet and check this number. Make a new compensation tokens, for example GARUDAcomp and CERBERUScomp. Send the new token to the holders, number exactly match number of old token. Make a swap contract so holders of new token can swap their token for a valued token at that time, swap ratio will be based on the value of GARUDA and CERBERUS at the time of exploit and the value of the valued token at the time of swap. This valued token will come from our dev fund, we do not mint new tokens to circulating supply, so it will not affect any current holders of this valued token."
"This is roughly the plan, we will make more detailed one in the future. We know that this should happen soon so we are talking with a professional team to do this services for us. But this will take time, because it is complicated, so please be patience with us!"
"After carefully analyzing data and checking exactly what each user has before the time of the exploit, we have finalized the compensation data for GARUDA."
GarudaSwap is a copy of PantherSwap. All funds are stored in a smart contract hot wallet. This contract had an error in the way deflationary tokens were handled, which caused extra rewards to be released.
All investors lost their funds as the hacker cashed out and the price of the token plummeted to zero. The project announced a compensation scheme, however nothing has materialized yet.
HOW COULD THIS HAVE BEEN PREVENTED?
Hot wallets should either not store customer funds, or be insured fully.
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
What exploit happened today for GoCerberus and Garuda, also for KetchupSwap, Lokum, YBear, Piggy, CaramelSwap and our rough compensation plan | by Thoreum Finance | Medium (Aug 29)
@JohnDoughBull Twitter (Sep 23)
@WatchPug_ Twitter (Sep 23)
@DappRadar Twitter (Sep 23)
Address 0xe959d028728a58bc794dbd025e36d558cdc439d2 | BscScan (Sep 24)
Binance Smart Chain DeFi Protocol Exploited and Token Drained to $0.00 by Hackers - Fxcryptonews (Sep 24)
Welcome to Yield Farm Library - Yield Farm (Sep 24)
https://docs.cottonfarm.app/security/recent-hacks (Sep 24)
GarudaSwap Finance (Oct 20)
https://coinmarketcap.com/currencies/garudaswap/ (Nov 6)
garudaswap (Nov 6)
Compensation plan for GARUDA : garudaswap (Nov 6)
GARUDA Compensation Data - Google Sheets (Nov 6)
@GarudaSwap Twitter (Nov 6)
