MOZART FINANCE

DESCRIPTION OF EVENTS

"Mozart Finance is a Binance Smart Chain defi project focused on yield farming and NFT's. Thе project developers are vеrу resilient іn making a platform whісh incorporates аll major applications оf DeFi lіkе yield farming, AMM, lotteries, betting, musical NFT's and much more. We expect that the platform will go big as time goes on."

"Mozart Finance is a fork from similar PancakeSwap and other Dex AMM DeFi projects. It aims to deliver DeFi features exclusively away from the traditional types. PIANO is the native token of the platform with the burn mechanisms embedded in its code to control inflation and a buy-back program to maintain the price."

"Low fees Using pancakeswap AMM while our is not finished trading fees are lower than other top decentralized exchanges too, so that's a double win for you!" "Trade directly from your wallet app (bsc wallet, metamask, trust wallet etc.) Unlike centralized exchanges like Binance or Coinbase, we don't hold your funds when you trade: you have 100% ownership of your own crypto. Do your own research!" "That's what we all are focused on. Musical NFT's are coming together with NFT's marketplace on BSC! Our roadmap will be updated shortly."

"According to the team, the last contract used on the test network was 100% secured; immunity Byte was paid to audit the code and was given a save rating." "ImmuneBytes team has performed thorough testing of the project starting with analyzing the code design patterns in which we reviewed the smart contract architecture to ensure it is structured and safe use of third-party smart contracts and libraries." "Our team then performed a formal line-by-line inspection of the Smart Contract in order to find any potential issues like Signature Replay Attacks, Unchecked External Calls, External Contract Referencing, Variable Shadowing, Race conditions, Transaction-ordering dependence, timestamp dependence, Dos attacks, and others."

"[A] project called Mozart finance that got hack by internal team. The developer left a backdoor in _mint function to a personal wallet address."

"Mozart’s contracted Solidity developer built a minting function in the PIANO contract’s code. He left the minter role in place, deeply rooted among the core functions of the contract."

"The deployed smart contract was swapped for a malicious one, containing the minting functions employed during the attack. These minting functions were not present in the code at the time of the audit." "[T]he original contract that was audited by ImmuneBytes did not have any externally exposed (public/external) mint functionality."

"The original code intended to have only a single minter role, the hacker, however, added a minter role for himself too. The attacker also did not transfer the Ownership to the intended recipient. The modified code also had an initial supply added to it, [[ uint256 private constant _initialSupply = 45000*10**18 ]], with the use of which a supply of 45K PIANOs would be transferred to whoever deployed the smart contract. This was something that the code did not intend to do, originally."

"The true logic of the project was based on a Decreasing Supply Model, implying that as the funds are transferred, 1% of the transferred tokens would be burned. For example, let’s say you were to farm 100 PIANOs. According to the project model, you would burn 1% of these 100 PIANOs and would acquire 99 PIANOs. The hacker altered this decreasing supply model such that no percentage of PIANOs were burnt, using transferFrom() function."

"We have been hacked. @cz_binance @binance Developer left a minting function from his address: 0xdA9f9d44F4c5022c789641802c10Da5992557D35."

"It turns out this outsourced developer slipped in a minting code without the original developers from the team and the project owners noticing. The project team had the code audited before deployment on the BSC network but failed to check the codes thoroughly again. After the audit it seems the outsourced developer must have handled the codes."

"For now, the team has warned traders through its handle to halt the purchase of $PIANO as the exploit hacker has minted over 100,000 PIANO tokens and is actively dumping."

“In short, we strongly advise you not to buy PIANO because the contract has NOT been fixed and is not safe. We are very sorry, but this is the inconvenient truth.”

"Users [had] the opportunity to vote any of the three options available to pick from; [a]irdrop new tokens to PIANO holders in a 1-to-1 ratio, [r]edeploy [the] PIANO smart contract and give a fair launch, or [c]lose the project."

"From the look of things, this is far from over for the Mozart Finance team as the odds are not on their side judging from the angry users’ response both on Twitter and Telegram platforms."

"That’s why we have decided to give our lovely community a chance to check our smart contract before we deploy them. This is our first ‘community check’ and it surely isn’t the last one! We plan to do this before the deployment of each and every smart contract — as transparent as possible."

"We’re happy to announce that the audit company our lovely community chose, Hacken, finished the official audit of MELODY contracts. After two reviews and thorough analysis of code functionalities, MELODY contracts passed its test with flying colors."

Mozart Finance launched their yield farming project with a professional audit from ImmuneBytes. However, they apparently also hired an external developer who installed a backdoor so they could withdraw funds after the audit.

The project was relaunched and obtained an audit from Hacken instead. There were no further problems noted. The website appears to be down at the moment, though social media is still online.

HOW COULD THIS HAVE BEEN PREVENTED?

The source of the problem was an anonymous developer who was able to create an exploit and provide a final modified version of code after the audit.

Check Our Framework For Safe Secure Exchange Platforms

Example Domain (Mar 23)
CertiK Blockchain Security Leaderboard (Jun 1)
Mozart Finance (Aug 21)
Mozart Finance - Mozart Finance (Aug 21)
Mozart Finance price today, MELODY to USD live, marketcap and chart | CoinMarketCap (Aug 21)
What the future holds for the Mozart Finance ecosystem? | by Mozart Finance | Medium (Aug 21)
[WARNING] mozart.finance hacked, 90k tokens minted, price down 90%. DON'T BUY THE DIP! : defi (Sep 19)
@MozartFinance Twitter (Sep 19)
Mozart Finance Have Been Hacked (Sep 19)
Let the bug hunt begin!. Dear Symphonists, | by Mozart Finance | Medium (Sep 19)
Smart-Contract-Audit-Reports/Mozart Finance (PIANO) - Final Audit Report.pdf at main · ImmuneBytes/Smart-Contract-Audit-Reports · GitHub (Sep 19)
audits/Mozart_SC_Audit_Report (3).pdf at main · mozartfinance/audits · GitHub (Sep 19)
Contract Address 0x1111cF91D816cF52b689E987e417006595d74391 | BscScan (Sep 19)
Contract Address 0xd46936677B2C1Bb696F2b67c55239331E2b7Cd42 | BscScan (Sep 19)
https://mobile.twitter.com/certikorg/status/1379971240736219140 (Jan 10)

More case studies

Force DAO Hedge
Fund Hack

Monster Slayer
Finance Rug Pull