Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/yologamesliquidityexitpoolcheckmissing.php}} {{Unattributed Sources}} YOLO Games Logo/HomepageThe YOLO Games platform is positioned as a premier destination for serious gamers, emphasizing substantial rewards and operated by an experienced team renowned for their provably fair on-chain games and inventive reward systems. Participants can earn game fees and D..."

2024-09-18T19:40:39Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/yologamesliquidityexitpoolcheckmissing.php}} {{Unattributed Sources}} thumb|YOLO Games Logo/HomepageThe YOLO Games platform is positioned as a premier destination for serious gamers, emphasizing substantial rewards and operated by an experienced team renowned for their provably fair on-chain games and inventive reward systems. Participants can earn game fees and D..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/yologamesliquidityexitpoolcheckmissing.php}}
{{Unattributed Sources}}

[[File:Yologames.jpg|thumb|YOLO Games Logo/Homepage]]The YOLO Games platform is positioned as a premier destination for serious gamers, emphasizing substantial rewards and operated by an experienced team renowned for their provably fair on-chain games and inventive reward systems. Participants can earn game fees and Droplets by providing liquidity, with Droplets redeemable for rewards at season’s end. Games against YOLO Games operate on a Liquidity Pool model, ensuring winners receive payouts without depleting the LP’s funds. Adding YOLO to LPs also earns Droplets, distinct from Points earned through gaming challenges, both of which accumulate YOLO over time due to a 1-2% LP advantage. Recent security incidents, including a $1.5 million theft due to a vulnerability in the exitPool function, have prompted immediate actions and refunds for affected participants in the YOLO LBP sale, which prematurely ended due to security concerns on Bazaar’s platform. Plans for future events remain on track, with updates forthcoming as investigations progress.<ref name="slowmisthackedarchive-14374" /><ref name="shoucccctwitter-14375" /><ref name="blastscan-14376" /><ref name="yoloblasttwitter-14377" /><ref name="shoucccctwitter-14378" /><ref name="yoloblasttwitter-14379" /><ref name="yoloblasttwitter-14380" /><ref name="yoloblasttwitter-14381" /><ref name="yoloblasttwitter-14382" />

== About YOLO Games ==
"THE HOME OF DEGEN GAMING The only venue for serious degens seeking serious rewards. Built by a veteran team with a track record of delivering provably fair, fun on-chain games and innovative reward systems."

"Provide liquidity to earn games fees and Droplets. Droplets earn you reward at the end of the season!"

"In games where you play against YOLO Games (versus PvP experiences), you effectively play against a Liquidity Pool (ETH or YOLO). This pool ensures that winners can be paid out without severely impacting the LP’s available funds."

"Add YOLO to the LP to earn Droplets. Not to be confused with Points (earned by gaming and completing challenges), these units will also earn YOLO at the end of the respective Season."

"Liquidity Pools have an edge over the player of 1-2% — which means that, over time, depositors can expect a steady increase in their YOLO position."

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
"$1.5 million was stolen from the liquidity pool on the Blast network’s gaming platform YOLO Games."
{| class="wikitable"
|+Key Event Timeline - YOLO Games Liquidity exitPool Check Missing
!Date
!Event
!Description
|-
|June 5th, 2024 12:03:00 PM MDT
|LBP Announcement
|The upcoming LBP is announced for the first time.
|-
|June 10th, 2024 6:12:00 AM MDT
|YOLO LBP Launch
|The launch of the YOLO LBP is announced to happen within 2 hours.
|-
|June 10th, 2024 1:54:09 PM MDT
|Blockchain Transaction
|The malicious blockchain transaction impersonating one of the liquidity providers occurs on the Blast blockchain.
|-
|June 10th, 2024 2:10:00 PM MDT
|Initial Yolo Games Tweet
|Yolo Games announces the vulnerability and their plan to offer refunds over the next few days.
|-
|June 10th, 2024 8:23:00 PM MDT
|Tweet About Transactions
|A tweet is posted which includes the impersonating transaction.
|-
|June 10th, 2024 9:30:00 PM MDT
|Hacker Refund Transaction
|A tweet is posted about the refund transaction of 90% of the funds from the hacker.
|-
|June 11th, 2024 5:59:00 AM MDT
|Refund Tweet Posted
|The Yolo Games tweets posts about providing refunds to every participant over 0.0001 ETH and that they will not be holding any further token launches. Their development will be funding another way, which will be announced in the future.
|}

== Technical Details ==
"$1.5 million was stolen from the liquidity pool on the Blast network’s gaming platform YOLO Games. The root cause was the lack of permission checks in the "exitPool" function, allowing anyone to impersonate liquidity providers and drain the pool. The attacker has already returned 90% of the stolen assets."

"$1.5M was hacked from the liquidity pool of @YOLO_Blast on @hiBazaar right after the UwU incident today. The root cause is no permission check in the `exitPool` function, allowing anyone to impersonate liquidity providers and drain the pool"

== Total Amount Lost ==
"$1.5 million"

The total amount lost has been estimated at $1,500,000 USD.

== Immediate Reactions ==
"Due to a reported security vulnerability on the Bazaar LBP smart contract, the YOLO LBP sale has ended ahead of time. Users will not be able to participate in the LBP any further. Any users holding rYOLO from purchasing during the sale will receive an ETH refund based on the amount spent, to be collated over the next few days.

We will provide further updates as we investigate the issue with the Bazaar and Blast teams."

== Ultimate Outcome ==
"Full refunds have been sent to all participants of the YOLO LBP sale who entered with at least 0.0001 ETH or more and were not in profit from trading.

If you entered with 1 ETH and the price moved down, you still got a 1 ETH refund.

You will be able to see the tx on Blastscan under “Internal Txns”.

The security exploit that affected Bazaar’s LBP contract is regretful, but we are undeterred. That said, there will no longer be a YOLO LBP or public sale of any kind. We are working on executing a new plan that will allow us to keep the previously communicated timeline for TGE etc, and will share more details ASAP."

== Total Amount Recovered ==
There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

== Ongoing Developments ==
What parts of this case are still remaining to be concluded?
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="slowmisthackedarchive-14374">[https://web.archive.org/web/20240617180525/https://hacked.slowmist.io/ SlowMist Hacked - SlowMist Zone] (Accessed Jun 20, 2024)</ref>

<ref name="shoucccctwitter-14375">[https://twitter.com/shoucccc/status/1800353122159833195 @shoucccc Twitter] (Accessed Jun 20, 2024)</ref>

<ref name="blastscan-14376">[https://blastscan.io/tx/0x7fdd140f7631f62d62f7256ee4a38af51a4723ad5d66adc9b9685bf78f750f2d Blast Mainnet Network Transaction Hash (Txhash) Details | Blastscan] (Accessed Jun 20, 2024)</ref>

<ref name="yoloblasttwitter-14377">[https://twitter.com/YOLO_Blast/status/1798415304672071968 @YOLO_Blast Twitter] (Accessed Jun 20, 2024)</ref>

<ref name="shoucccctwitter-14378">[https://twitter.com/shoucccc/status/1800370104842272772 @shoucccc Twitter] (Accessed Jun 20, 2024)</ref>

<ref name="yoloblasttwitter-14379">[https://twitter.com/YOLO_Blast/status/1799906491408973909 @YOLO_Blast Twitter] (Accessed Jun 20, 2024)</ref>

<ref name="yoloblasttwitter-14380">[https://twitter.com/YOLO_Blast/status/1800138994484977883 @YOLO_Blast Twitter] (Accessed Jun 20, 2024)</ref>

<ref name="yoloblasttwitter-14381">[https://twitter.com/YOLO_Blast/status/1800259276277198952 @YOLO_Blast Twitter] (Accessed Jun 20, 2024)</ref>

<ref name="yoloblasttwitter-14382">[https://twitter.com/YOLO_Blast/status/1800498155731218589 @YOLO_Blast Twitter] (Accessed Jun 20, 2024)</ref></references>

YOLO Games Liquidity exitPool Check Missing - Revision history