$5 000 000 USD





XSurge describes itself as "The Defi Revolution". "Explore our fast growing smart chain ecosystem that fosters innovation and encourages a truly decentralized future through on-chain liquidity, and fully renounced ownership."


"Each transaction triggers a fee that raises the price of Surge relative to its underlying asset. That means Buys, Transfers, and Sells raise the price." "6% fee to buy, 6% fee to sell, 7% fee to navigate between tokens (i.e., SETH to SBTC) & 2% fee for wallet-to-wallet transfers."


"In accordance with the our Security First Approach, we have undergone and completed third party verification of our SurgeETH Token Contract. The audit was conducted through Certik, a highly esteemed blockchain auditor. Using their in-house formal verification technology, Certik provides a thorough assessment that outlines vulnerability ranking scores for various factors. Following completion of the audit, we are happy to report SurgeETH has earned an admirable rating for these factors along with a very high Security Score. In addition, SurgeETH will be under 24/7 Skynet Monitoring from the Certik Dashboard to further assure our community that security and integrity are always our first priority."


"Surge even boasted a well-known developer from SafeMoon, SafemoonMark - SafeMoon CEO, John Karony, has since announced he is no longer apart of the team." "SafemoonMark came out as the to be the writer of Surge code and mentioned safety from Rug Pulls via a Tweet on July 30th."


"The Surge ETH Protocol is a decentralized finance (DeFi) token deployed on the Binance smart chain(BSC). Send BNB to this contract and it mints Surge Token to your receive address, then BNB will beexchanged for _token. _token is ETH. When selling Surge Token by interacting with the contract directly,the price is calculated as a ratio between the underlying asset of _token and total supply in the contract.When the user mistakenly transfers other tokens to this contract, owner can convert these tokens into_token."


“With ownership fully renounced, no liquidity, and no need for DApps, there is no possibility of a rug pull or whale dominance,” Is the lofty statement on the XSurge webpage. Although that has been categorically proven untrue, it does not stop others from being influenced.


“There is absolutely no risk of a rug pull! There is no liquidity, no dev tokens, no exchange or the possibility of whales monopolizing ownership.” This was the statement in the most recent Medium post by AG Digikemet, an apparent supporter and volunteer.


"In the same tweet XSurge noted that it had been a backdoor exploit, meaning normal processes had been bypassed. The team also tried to quell fears of a further attack by explaining that SurgeUSD and SurgeETH do not withdraw BNB and therefore cannot be exploited in the same manner."


"After an initial investigation, it seems to be a reentrancy-based price manipulation attack." "SURGEBNB got pwned by an external call before important state updates. A call to sell resulted in BnB being sent back to the user allowing an additional call to purchase(...) before the _totalSupply was updated."


"The attacker utilized the fallback function which would purchase surge tokens. They performed the sell/purchase attack about 8 times and profited ~12,161.157 BNB after paying off the flash loan."


"#SurgeFund Has Launched! Next 36 hours will be spent verifying with the community that our snapshot data was correct, then we will allow victims of August 16th to claim BNB daily, permitting there are funds available to claim!" "The CertiK audit for #SurgeETH is officially underway!"

The XSurge smart contract was exploited and $5m was taken from investors.


It appears that XSurge is making efforts to recompensate affected users. They put out an initial snapshot of balances to be compensated. They also completed an audit with CertiK.


In general, smart contract funds should be considered as a form of hot wallet. Its better to have funds in offline multi-signature storage, which could be used for the majority of funds when the team is known. When not possible, there exist protocols to provide insurance, and an industry fund can serve as an alternative to ensure investors are protected.


Check Our Framework For Safe Secure Exchange Platforms

Sources And Further Reading

 For questions or enquiries, email info@quadrigainitiative.com.

Get Social

  • email
  • reddit
  • telegram
  • Twitter

© 2021 Quadriga Initiative. Your use of this site/service accepts the Terms of Use and Privacy Policy. This site is not associated with Ernst & Young, Miller Thompson, or the Official Committee of Affected Users. Hosted in Canada by HosterBox.