QUADRIGA INITIATIVE
CRYPTO WATCHDOG & FRAUD RECOVERY PLATFORM
A COMMUNITY-BASED, NOT-FOR-PROFIT
UNKNOWN
JUNE 2021
GLOBAL
LOKUM FINANCE
DESCRIPTION OF EVENTS
"LokumFinance is an automated market maker (AMM) — a decentralized finance (DeFi) application that allows users to exchange tokens, providing liquidity via farming and earning fees in return."
"Welcome to Lokum Finance The ultimate delighted yield farm with a burn and buyback burning program." "Lokum Presale will start from 30th March 2021 (Tuesday) 08:00 UTC to 5th April 2021 (Monday) 08:00 UTC" "Presale collect will be added before the Farm start." "Farming will start at 7th April 2021 (Wednesday) 11:40 UTC" "In order to guarantee full security, the migrator code has been removed from our MasterChef contract." "In order to increase autonomy,LKM owner would be transfer to Farming Contract after adding liquidity." "Buyback & burning will be done manually in order to stabilize the token price."
"It launched in April 2021 and is a decentralized exchange for swapping BEP20 tokens on Binance Smart Chain. LokumFinance uses an automated market maker model where users trade against a liquidity pool. These pools are filled by users who deposit their funds into the pool and receive liquidity provider (LP) tokens in return."
"When users put their tokens into liquidity pools and stake their LP tokens in a farm, they put their crypto tokens in a bank. But this time the bank is a protocol created by someone anonymous. Especially users that move between the high-APY yield farms are at risk."
On "June 16th, multiple farms their native tokens were exploited all the way to $0.00. KetchupSwap, Lokum, YBear, Piggy, CaramelSwap. Sadly enough GoCerberus and Garuda were exploited as well." "A major exploit has affected multiple BSC farms by driving their native token prices to 0." "Cerberus, Garuda, KetchupSwap, Piggy, CaramelSwap, and a few more projects got exploited at the same time, because of mishandling of tokens with transfer tax."
"We are being hacked. And it continues can BSC help us ????? Ther is over mint."
"Most of the yield farms use a trusted contract called a MasterChef, which is used even by PancakeSwap themselves to distribute rewards. The problem is that the MasterChef was never designed for all these special tokens, it was designed specifically to receive rewards for LP tokens."
"But, yield farms kept popping up and adding non-LP tokens and everything was fine. Until recently tokens with a transfer fee became more popular. Most of our tokens have a transfer fee as well, it’s how we can have our tokenomics. But the problem is that the MasterChef was not designed for this."
"Due to the design of the masterchef if you stake 100 tokens (with a 5% transaction fee) in a MasterChef, you are still able to withdraw 100 tokens from the MasterChef. But due to the transfer fee, only 95 tokens actually arrived in the contract."
"Due to the inner workings of the Masterchef, once user balances grow larger then the total token balance in the pool, they effectively get a multiplier on their rewards. Anyone that was still in the Garuda pool was getting way larger harvests then they should."
"In the masterchef, the rewards per staked token are actually calculated by dividing the pool emissions by the total tokens in the contract." "[I]f there is 1 token remaining in the masterchef, the rewards per token are equal to the total emissions of that pool. So what happens in our previous case when there may only be 0.001 token in the pool and users still have a balance of thousands of tokens? Their harvests are thousands of times larger then what they should be."
"After discussing with our engineers, we thought about a method to ‘whitehat’ these funds and had actually started developing and deploying the contracts for this (essentially they would use the referral method above to mint a large amount of tokens). Although we believed we would have been able to secure these funds given a bit more time, we were not able to deploy and execute the whitehat contract our devs developed within time and at some point we were informed that it was ‘too late’. A very stressful call where everyone on the team was doing everything they could became silent. We did what we could. Sadly enough so many other projects today were vulnerable to the same exploit. It is a novel exploit and nobody was ready for it. We did our absolute best to salvage the remaining funds."
"The exact value that hackers stole is still unclear. However, hackers may have gotten away with an amount equal to the market cap of [the] project."
"If you were in @KetchupSwap or @FinanceLokum before they got exploited, you can fill out [a] form to receive some compensation."
Lokum Finance is a copy of PantherSwap. All funds were stored in a smart contract hot wallet. This contract had an error in the way deflationary tokens were handled, which caused extra rewards to be released.
All investors lost their funds as the hacker cashed out and the price of the token plummeted to zero. The project has not relaunched. The website is still offline with a zero balance and the Twitter page has been deleted.
HOW COULD THIS HAVE BEEN PREVENTED?
Hot wallets should either not store customer funds, or be insured fully through the suggested industry insurance fund.
blocksec-incidents/2021.md at main · openblocksec/blocksec-incidents · GitHub (Aug 11)
What exploit happened today for GoCerberus and Garuda, also for KetchupSwap, Lokum, YBear, Piggy, CaramelSwap and our rough compensation plan | by Thoreum Finance | Medium (Aug 29)
@JohnDoughBull Twitter (Sep 23)
@WatchPug_ Twitter (Sep 23)
@DappRadar Twitter (Sep 23)
Address 0xe959d028728a58bc794dbd025e36d558cdc439d2 | BscScan (Sep 24)
Binance Smart Chain DeFi Protocol Exploited and Token Drained to $0.00 by Hackers - Fxcryptonews (Sep 24)
Welcome to Yield Farm Library - Yield Farm (Sep 24)
@FinanceLokum Twitter (Sep 23)
@JohnDoughBull Twitter (Sep 23)
Lokum finance & Ketchup swap (Sep 24)
Lokum Finance | DappRadar (Oct 16)
LokumFinance Defi Network (Oct 16)
https://coinmarketcap.com/currencies/lokum-finance/ (Nov 5)
https://twitter.com/FinanceLokum (Nov 5)
https://web.archive.org/web/20210423113958/https://lokumswap-finance.medium.com/ (Nov 5)
Lokum - Coming soon (Nov 5)
LokumFinance (Nov 5)
https://lokumswap-finance.medium.com/ (Nov 5)
