BOGGED FINANCE

DESCRIPTION OF EVENTS

"The Bogged.Finance Platform allows you to research and place orders for any token on Binance Smart Chain." "Our Limit Order platform takes advantage of PancakeSwap's Liquidity, in the future the platform will take advantage of multiple Decentralised Exchanges, allowing your order to be filled at the best possible price." "You can view charts for any token with liquidity in PancakeSwap for free with Bogged Finance's Charts. This includes vital information such as liquidity and marketcap. Updates and improvements to the chart platform will continue to be rolled out in the coming weeks and months."

"Bogged Finance is a token which runs code each time it is executed for various use-cases, including real-time and historical decentralised oracles on Binance Smart Chain."

"Binance Smart Chain protocol Bogged Finance has lost a whopping $3 million of its native token $BOG." "$3 million worth of funds w[ere] drained from its liquidity pool on PancakeSwap." "Of note, the $3 million lost represents almost half of Bogged Finance’s total liquidity." "The $BOG token was exploited by an unknown attacker who was able to drain $3m of the $6m liquidity using a complex Flash-Loan based attack." "In a post mortem published on May 23, security firm PeckShield detailed the attack that resulted in a malicious actor making off with $3.6 million."

"We are aware of the flash loan attack against BOG and are as devastated as you. We believe we have prevented further theft against more of our liquidity."

"The old $BOG token was exploited due to a flaw in the staking portion of the token contract, which allowed a hacker to inflate the supply and dump the tokens on the market." "As reported by PeckShield, the incident happened through the exploitation of a bug in the BOG token contract. The contract in reality has been designed to be deflationary in nature by charging 5% of the transferred amount. Of this 5%, 1% is burned and the remaining 4% is taken as a fee for staking charges."

"At the same time, the token contract implementation only charges 1% of the transferred amount but still inflates the 4% as the staking profit. The blog post notes:"

“As a result, the attacker can take advantage of flashloans to significantly increase the staking amount and repeatedly perform self-transfers to claim the inflated staking profit. After that, the attacker immediately sells the inflated BOG for about $3.6M WBNB”.

"This has been rectified in version 2 of the $BOG contract, and $BOG and BogTools is ready to come back stronger than ever. We have completed an audit with a third party and will get additional audits done post-launch."

"The Bogged Finance Token Migration is taking longer than expected. The funds are being held securely in this wallet, until redeployment is complete. We are excited to launch the new version of the BOG Contract with over 7.5 million tokens burned. We will announce a countdown for the relaunch before launch."

"The $BOG token will be relaunched at 9PM UTC on June 1st 2021, in under 15 hours from this post going live." "Currently, tokens are being airdropped via the bogged.finance platform to pre-snapshot holders, and trading will be re-enabled at 9PM UTC. The interest in $BOG is immense and we’re excited to continue to build $BOG and the Bogged.Finance platform." "BOG will launch approximately 70% below its all-time high market cap. Original pre-exploit holders were diluted by approximately 3–3.5x."

"We have had incredible interest in the relaunch of BOG, with our telegram exploding to almost 25,000 members. In terms of marketing, we have activated a massive banner on the charts platform which is being seen by hundreds of thousands of people per day — inviting them to the relaunch of $BOG. In addition, we will be activating marketing with a variety of partners pre and post-launch." "BOG is a long-term project and we are here to stay, we will not be rushing this migration."

Another breach of a liquidity pool. In this case, the exploit was stopped part-way through draining the funds.

The team plans to relaunch. There is some concern over dilution of the token supply in their new plan. They seem optimistic given the large number of people following the project. However, it's really unclear if people coming after seeing the hack will be enthusiastic investors.

HOW COULD THIS HAVE BEEN PREVENTED?

While decentralized finance continues to improve in security over time by learning from incidents like these, it remains that air-gapped storage held by a multi-sig of reputable individuals is a far more secure method of storage.

Check Our Framework For Safe Secure Exchange Platforms

Flash Loan Attacks Drain 2 Binance Smart Chain Defi Projects for $6 Million – News Bitcoin News (May 24)
Bogged Finance Homepage (Jun 2)
Bog Flash Loan Attack What Happened And Whats Next Token Migration (Jun 2)
BSC-Based Bogged Finance Lost $3m To Hackers (Jun 2)
Another Binance Smart Chain Project Suffers an Attack | Crypto Briefing (Jun 2)
@bogtools Twitter (Jun 2)
@bogtools Twitter (Jun 2)
@boggedfinance Twitter (Jun 2)
The Bog Relaunch Everything You Need To Know (Jun 2)
Medium Update 1 New Bog Token Tokenomics Details (Jun 2)
Binance Smart Chain-based Bogged Finance Falls Victim to Flash Loan Attack, BOG Tanks 98% (Jun 2)
Bogged Finance Incident Root Cause Analysis (Jun 2)
DeFi Flash Swap Attack Drains Bogged Finance of $3.6M - BeInCrypto (Jun 2)
SlowMist Hacked - SlowMist Zone (May 18)
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
https://github.com/OriginProtocol/security/blob/master/incidents/2021-5-22-Bog-Finance.md (Aug 11)
CertiK Blockchain Security Leaderboard (Jun 1)

More case studies

ShibaSwap
Phishing Site

AutoShark
Economic Exploit