GemSwap "Developer Attack" - Revision history

Azoundria at 17:54, 2 May 2023

2023-05-02T17:54:43Z

Azoundria: Azoundria moved page GemSwap to GemSwap "Developer Attack": Original page had the wrong name.

2023-05-02T17:54:28Z

Azoundria moved page GemSwap to GemSwap "Developer Attack": Original page had the wrong name.

← Older revision	Revision as of 11:54, 2 May 2023
(No difference)

Azoundria at 17:23, 17 February 2023

2023-02-17T17:23:55Z

Azoundria: Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/gemswapdeveloperattack.php}} GemSwapUnknown developers created a fork of popular UniSwap/SushiSwap. After many people were convinced to add liquidity to the smart contract, malicious backdoors were used to empty the liquidity and steal user funds. This is a global/international case not involving a specific country. == About GemSwap == "GemSwap is described to be a for..."

2023-01-25T18:42:44Z

Created page with "{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/gemswapdeveloperattack.php}} thumb|GemSwapUnknown developers created a fork of popular UniSwap/SushiSwap. After many people were convinced to add liquidity to the smart contract, malicious backdoors were used to empty the liquidity and steal user funds. This is a global/international case not involving a specific country. == About GemSwap == "GemSwap is described to be a for..."

New page

{{Imported Case Study|source=https://www.quadrigainitiative.com/casestudy/gemswapdeveloperattack.php}}

[[File:Gemswap.jpg|thumb|GemSwap]]Unknown developers created a fork of popular UniSwap/SushiSwap. After many people were convinced to add liquidity to the smart contract, malicious backdoors were used to empty the liquidity and steal user funds.

This is a global/international case not involving a specific country.

== About GemSwap ==
"GemSwap is described to be a fork of Uniswap and Sushiswap. GEM is the profit sharing and governance token of GemSwap. There is no pre-mine or dev grant. GEM is described to be mined over a 2 weeks mining period. The total supply is hard capped at 80,064,000. GEM is deflationary - GemSwap profit sharing is done by using portion of exchange fee to buy-back GEMs and burn. No new tokens will be minted."

"We are currently working on a new farming concept which provides future profitable use of $GEM while also encouraging higher trading volume for GemSwap exchange. This in turn, will create an eco-system for $GEM holders to profit over the short-term and long-term."

"We liked the SUSHI experiment, but wanted to make an improvement on it’s tokenomics. The inflationary property of $SUSHI resulted in the constant decline of it’s token price due to sell-pressure."

"$GEM on the other hand is deflationary, and has constant buy-pressure created by the protocol itself. We believe this will help to increase the price of GEM and make way for long term success of the exchange."

"[I]t seems like it had all the classic safety checks most people ask for. The Uniswap LP staking contract was identical to that of Sushi. It had a timelock. The problem came when it was migrated to a malicious Gemswap LP token."

"On September 26, the SushiSwap imitation project named GemSwap was exposed and LP was taken away. The query found that the project posted a tweet at around 15:00 today and revealed that it was attacked by the developer of "whatitdobb". It is understood that the project completed the liquidity migration earlier today, but the developer who initiated the attack had The relevant permission was obtained and the tokens in the liquidity pool were able to be taken away. The specific losses caused by this attack are currently unclear." "Gemswap rugged their LP pools by using a malicious migrator. 1.3$M taken"

"There was a small window where damages could've been limited due to time-lock of the Migrator (which was not rogue per se, the attacker needed migration to complete). The attack was possible due to the GemSwap Pair having the emergencyWithdraw function as well."

"With all the higher profile hacks, smaller incidents are often overlooked. The #GemSwap incident while relatively small, deserves attention from the community as well as there are many lessons to learn."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

* Known history of when and how the service was started.
* What problems does the company or service claim to solve?
* What marketing materials were used by the firm or business?
* Audits performed, and excerpts that may have been included.
* Business registration documents shown (fake or legitimate).
* How were people recruited to participate?
* Public warnings and announcements prior to the event.

Don't Include:

* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
* Anything that wasn't reasonably knowable at the time of the event.
There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.
{| class="wikitable"
|+Key Event Timeline - GemSwap "Developer Attack"
!Date
!Event
!Description
|-
|September 26th, 2020 12:00:00 AM
|First Event
|This is an expanded description of what happened and the impact. If multiple lines are necessary, add them here.
|-
|
|
|
|-
|
|
|
|}

== Total Amount Lost ==
The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

== Immediate Reactions ==
How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

== Ultimate Outcome ==
What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

== Total Amount Recovered ==
It is unknown how much was recovered.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?

== Prevention Policies ==
Were there an above-ground method for financial innovation to occur, projects would not need to start via anonymous teams. Safe multi-signature wallets/contracts held by known entities could be used to prevent abuse.

== References ==
[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)

[https://etherscan.io/token/0x90f62B96a62801488b151fF3c65eaC5Fae21a962 $0.0032 | GemToken (GEM) Token Tracker | Etherscan] (Jul 25)

[https://medium.com/@gemswap1 GemSwap.org – Medium] (Jul 25)

[https://etherscan.io/address/0x90f62B96a62801488b151fF3c65eaC5Fae21a962#contracts GemSwap: GEM Token | 0x90f62B96a62801488b151fF3c65eaC5Fae21a962] (Jul 25)

[https://t.me/Gemswap20 Telegram: Contact @Gemswap20] (Jul 25)

[https://blockspot.io/coin/gemswap/ GemSwap (GEM) Price, Graph, Data, Social and more] (Jul 25)

[https://twitter.com/Degenify/status/1310630091815256069 @Degenify Twitter] (Jul 25)

[https://twitter.com/Elixer_7/status/1309568903039856642 @Elixer_7 Twitter] (Jul 25)

[https://twitter.com/haikukoten/status/1309509087701295105 @haikukoten Twitter] (Jul 25)

[https://twitter.com/CryptoCulgin/status/1310922769211645955 @CryptoCulgin Twitter] (Jul 25)

[https://twitter.com/Antimajinsayan/status/1309800792992493570 @Antimajinsayan Twitter] (Jul 25)

[https://twitter.com/DefiDrew/status/1305385991432151040 @DefiDrew Twitter] (Jul 25)

[https://twitter.com/siiimonincrypto/status/1306513147076005888 @siiimonincrypto Twitter] (Jul 25)

[https://twitter.com/tjkrypto/status/1309760363722801153 @tjkrypto Twitter] (Jul 25)

[https://twitter.com/Degenify/status/1310836817550336002 @Degenify Twitter] (Jul 25)

[https://twitter.com/xbtsimpx/status/1312634986730717185 @xbtsimpx Twitter] (Jul 25)

[https://twitter.com/CryptoCulgin/status/1310922745350250499 @CryptoCulgin Twitter] (Jul 25)

[https://twitter.com/0xArch/status/1306256979690754048 @0xArch Twitter] (Jul 25)

[https://twitter.com/FinancierLord/status/1309913851077558274 @FinancierLord Twitter] (Jul 25)

[https://twitter.com/0xdeadf4ce/status/1309987504909582336 @0xdeadf4ce Twitter] (Jul 25)

[https://twitter.com/Mhr_de_Uil/status/1308890688612958210 @Mhr_de_Uil Twitter] (Jul 25)

[https://twitter.com/futrtrndy/status/1309968406720868352 @futrtrndy Twitter] (Jul 25)

[https://twitter.com/DoveyWan/status/1309823302718775296 @DoveyWan Twitter] (Jul 25)

[https://www.certik.org/blog/blockchain-hacks-2020-15-billion-lost-how-can-we-mitigate-hacks-in-2021 Blockchain Hacks: 2020 | $15 billion lost, how can we mitigate hacks in 2021? | CertiK Foundation Blog] (Jul 22)

[https://hacked.slowmist.io/en/?c=EOS SlowMist Hacked - SlowMist Zone] (Nov 7)

← Older revision		Revision as of 11:23, 17 February 2023
Line 1:		Line 1:
	{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/gemswapdeveloperattack.php}}		{{Imported Case Study\|source=https://www.quadrigainitiative.com/casestudy/gemswapdeveloperattack.php}}
			{{Unattributed Citations}}

	[[File:Gemswap.jpg\|thumb\|GemSwap]]Unknown developers created a fork of popular UniSwap/SushiSwap. After many people were convinced to add liquidity to the smart contract, malicious backdoors were used to empty the liquidity and steal user funds.		[[File:Gemswap.jpg\|thumb\|GemSwap]]Unknown developers created a fork of popular UniSwap/SushiSwap. After many people were convinced to add liquidity to the smart contract, malicious backdoors were used to empty the liquidity and steal user funds.

	This is a global/international case not involving a specific country.		This is a global/international case not involving a specific country.
			<ref name="slowmisthacked-678" /><ref name="etherscan-1816" /><ref name="gemswap1medium-1817" /><ref name="etherscan-1818" /><ref name="gemswap20telegram-1819" /><ref name="blockspot-1820" /><ref name="degenifytwitter-1821" /><ref name="elixer7twitter-1822" /><ref name="haikukotentwitter-1823" /><ref name="cryptoculgintwitter-1824" /><ref name="antimajinsayantwitter-1825" /><ref name="defidrewtwitter-1826" /><ref name="siiimonincryptotwitter-1827" /><ref name="tjkryptotwitter-1828" /><ref name="degenifytwitter-1829" /><ref name="xbtsimpxtwitter-1830" /><ref name="cryptoculgintwitter-1831" /><ref name="0xarchtwitter-1832" /><ref name="financierlordtwitter-1833" /><ref name="0xdeadf4cetwitter-1834" /><ref name="mhrdeuiltwitter-1835" /><ref name="futrtrndytwitter-1836" /><ref name="doveywantwitter-1837" /><ref name="certik-1776" /><ref name="slowmisthacked-3935" />

	== About GemSwap ==		== About GemSwap ==
Line 37:		Line 39:

	Don't Include:		Don't Include:

	* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.		* Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
	* Anything that wasn't reasonably knowable at the time of the event.		* Anything that wasn't reasonably knowable at the time of the event.
Line 59:		Line 60:
	\|-		\|-
	\|September 26th, 2020 12:00:00 AM		\|September 26th, 2020 12:00:00 AM
	\|~~First~~ Event		\|Main Event
	\|~~This is an expanded~~ description of what happened and the impact. If multiple lines are necessary, add them here.		\|Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.
	\|-
	\|
	\|
	\|
	\|-		\|-
	\|		\|
Line 72:		Line 69:

	== Total Amount Lost ==		== Total Amount Lost ==
	The total amount lost ~~is unknown~~.		The total amount lost has been estimated at $1,300,000 USD.

	How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?		How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?
Line 83:		Line 80:

	== Total Amount Recovered ==		== Total Amount Recovered ==
	~~It is unknown how much was~~ recovered.		There do not appear to have been any funds recovered in this case.

	What funds were recovered? What funds were reimbursed for those affected users?		What funds were recovered? What funds were reimbursed for those affected users?
Line 94:		Line 91:

	== References ==		== References ==
	[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17)		<references><ref name="slowmisthacked-678">[https://hacked.slowmist.io/en/?c=ETH%20DApp SlowMist Hacked - SlowMist Zone] (May 17, 2021)</ref>

	[https://etherscan.io/token/0x90f62B96a62801488b151fF3c65eaC5Fae21a962 $0.0032 \| GemToken (GEM) Token Tracker \| Etherscan] (Jul 25)		<ref name="etherscan-1816">[https://etherscan.io/token/0x90f62B96a62801488b151fF3c65eaC5Fae21a962 $0.0032 \| GemToken (GEM) Token Tracker \| Etherscan] (Jul 25, 2021)</ref>

	[https://medium.com/@gemswap1 GemSwap.org – Medium] (Jul 25)		<ref name="gemswap1medium-1817">[https://medium.com/@gemswap1 GemSwap.org – Medium] (Jul 25, 2021)</ref>

	[https://etherscan.io/address/0x90f62B96a62801488b151fF3c65eaC5Fae21a962#contracts GemSwap: GEM Token \| 0x90f62B96a62801488b151fF3c65eaC5Fae21a962] (Jul 25)		<ref name="etherscan-1818">[https://etherscan.io/address/0x90f62B96a62801488b151fF3c65eaC5Fae21a962#contracts GemSwap: GEM Token \| 0x90f62B96a62801488b151fF3c65eaC5Fae21a962] (Jul 25, 2021)</ref>

	[https://t.me/Gemswap20 Telegram: Contact @Gemswap20] (Jul 25)		<ref name="gemswap20telegram-1819">[https://t.me/Gemswap20 Telegram: Contact @Gemswap20] (Jul 25, 2021)</ref>

	[https://blockspot.io/coin/gemswap/ GemSwap (GEM) Price, Graph, Data, Social and more] (Jul 25)		<ref name="blockspot-1820">[https://blockspot.io/coin/gemswap/ GemSwap (GEM) Price, Graph, Data, Social and more] (Jul 25, 2021)</ref>

	[https://twitter.com/Degenify/status/1310630091815256069 @Degenify Twitter] (Jul 25)		<ref name="degenifytwitter-1821">[https://twitter.com/Degenify/status/1310630091815256069 @Degenify Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/Elixer_7/status/1309568903039856642 @Elixer_7 Twitter] (Jul 25)		<ref name="elixer7twitter-1822">[https://twitter.com/Elixer_7/status/1309568903039856642 @Elixer_7 Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/haikukoten/status/1309509087701295105 @haikukoten Twitter] (Jul 25)		<ref name="haikukotentwitter-1823">[https://twitter.com/haikukoten/status/1309509087701295105 @haikukoten Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/CryptoCulgin/status/1310922769211645955 @CryptoCulgin Twitter] (Jul 25)		<ref name="cryptoculgintwitter-1824">[https://twitter.com/CryptoCulgin/status/1310922769211645955 @CryptoCulgin Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/Antimajinsayan/status/1309800792992493570 @Antimajinsayan Twitter] (Jul 25)		<ref name="antimajinsayantwitter-1825">[https://twitter.com/Antimajinsayan/status/1309800792992493570 @Antimajinsayan Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/DefiDrew/status/1305385991432151040 @DefiDrew Twitter] (Jul 25)		<ref name="defidrewtwitter-1826">[https://twitter.com/DefiDrew/status/1305385991432151040 @DefiDrew Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/siiimonincrypto/status/1306513147076005888 @siiimonincrypto Twitter] (Jul 25)		<ref name="siiimonincryptotwitter-1827">[https://twitter.com/siiimonincrypto/status/1306513147076005888 @siiimonincrypto Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/tjkrypto/status/1309760363722801153 @tjkrypto Twitter] (Jul 25)		<ref name="tjkryptotwitter-1828">[https://twitter.com/tjkrypto/status/1309760363722801153 @tjkrypto Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/Degenify/status/1310836817550336002 @Degenify Twitter] (Jul 25)		<ref name="degenifytwitter-1829">[https://twitter.com/Degenify/status/1310836817550336002 @Degenify Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/xbtsimpx/status/1312634986730717185 @xbtsimpx Twitter] (Jul 25)		<ref name="xbtsimpxtwitter-1830">[https://twitter.com/xbtsimpx/status/1312634986730717185 @xbtsimpx Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/CryptoCulgin/status/1310922745350250499 @CryptoCulgin Twitter] (Jul 25)		<ref name="cryptoculgintwitter-1831">[https://twitter.com/CryptoCulgin/status/1310922745350250499 @CryptoCulgin Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/0xArch/status/1306256979690754048 @0xArch Twitter] (Jul 25)		<ref name="0xarchtwitter-1832">[https://twitter.com/0xArch/status/1306256979690754048 @0xArch Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/FinancierLord/status/1309913851077558274 @FinancierLord Twitter] (Jul 25)		<ref name="financierlordtwitter-1833">[https://twitter.com/FinancierLord/status/1309913851077558274 @FinancierLord Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/0xdeadf4ce/status/1309987504909582336 @0xdeadf4ce Twitter] (Jul 25)		<ref name="0xdeadf4cetwitter-1834">[https://twitter.com/0xdeadf4ce/status/1309987504909582336 @0xdeadf4ce Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/Mhr_de_Uil/status/1308890688612958210 @Mhr_de_Uil Twitter] (Jul 25)		<ref name="mhrdeuiltwitter-1835">[https://twitter.com/Mhr_de_Uil/status/1308890688612958210 @Mhr_de_Uil Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/futrtrndy/status/1309968406720868352 @futrtrndy Twitter] (Jul 25)		<ref name="futrtrndytwitter-1836">[https://twitter.com/futrtrndy/status/1309968406720868352 @futrtrndy Twitter] (Jul 25, 2021)</ref>

	[https://twitter.com/DoveyWan/status/1309823302718775296 @DoveyWan Twitter] (Jul 25)		<ref name="doveywantwitter-1837">[https://twitter.com/DoveyWan/status/1309823302718775296 @DoveyWan Twitter] (Jul 25, 2021)</ref>

	[https://www.certik.org/blog/blockchain-hacks-2020-15-billion-lost-how-can-we-mitigate-hacks-in-2021 Blockchain Hacks: 2020 \| $15 billion lost, how can we mitigate hacks in 2021? \| CertiK Foundation Blog] (Jul 22)		<ref name="certik-1776">[https://www.certik.org/blog/blockchain-hacks-2020-15-billion-lost-how-can-we-mitigate-hacks-in-2021 Blockchain Hacks: 2020 \| $15 billion lost, how can we mitigate hacks in 2021? \| CertiK Foundation Blog] (Jul 22, 2021)</ref>

	[https://hacked.slowmist.io/en/?c=EOS SlowMist Hacked - SlowMist Zone] (Nov 7)		<ref name="slowmisthacked-3935">[https://hacked.slowmist.io/en/?c=EOS SlowMist Hacked - SlowMist Zone] (Nov 7, 2021)</ref></references>