PolkaMetaverse Fake Audit

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

PolkaMetaverse

PolkaMetaverse is currently claiming to be audited when no such audit has been performed, according to Peckshield. It remains to be seen what will come of this project and any investments. The whitepaper claims a multi-sig but no one has looked into the code.

About PolkaMetaverse

"Polkametaverse is a Next-generation NFT platform." "Polkametaverse is a new generation of decentralized exchange, using a Layer 2 scalability engine, supporting leveraged transactions, and providing lower transaction rates. POKA is the governance token of Polkametaverse, with a total supply of only 100,000,000. POKA will be listed on Hotbit, Binance Trust Wallet, Bybit and Coinbase exchanges. The estimated listing price of POKA is $30." "A new generation of decentralized exchange using a Layer 2 scalability engine. Trade Perpetual Contracts with low fees, deep liquidity, and up to 100× more Buying Power."

"Polkametaverse joined hands with Kusama and StarkWare which employed StarkEx, a Layer 2 scalability engine that aims to improve the trading on platform. In simple words, the impact will be similar to the upcoming Eth 2.0 upgrade, as the gas costs will become zero, minimum trade sizes will be reduced, and trading fees will be lower."

"The purpose of Polkametaverse is to provide secure trading services with low gas costs and fees. To achieve this, the platform is now moving towards Layer 2 with the help of StarkWare to increase its trade settlement capacity."

"We present a set of protocols that allow several types of financial products to be created, issued, and traded for any pair of underlying ERC20 tokens. Our approach uses off-chain order books with on-chain settlement to allow creation of efficient markets. All described protocols are fair and trustless, creating truly open markets that are not governed by a central authority. The protocols are extensible by anyone, requiring no special permissions to be used with other smart contracts."

"Please share your BNB address here and we will send 500 POKA tokens to first 100 People." "Every participant can get 10 POKA tokens by participating in airdrop. Copy and share your referral link to your friends .After the airdrop ends, POKA tokens will be automatically distributed to your submitted BNB wallet address."

"Use your wallet send BNB to the Pre-sale address. Our system will send tokens to your wallet."

Polkametaverse claimed to be audited by Peckshield.

Early Promotions on Twitter

Airdrop from our side for the community Please share your BNB address here and we will send 500 POKA tokens to first 100 People

Airdrop is Live https://polkametaverse.io/#airdrop Every participant can get 10 POKA tokens by participating in airdrop. Copy and share your referral link to your friends .After the airdrop ends, POKA tokens will be automatically distributed to your submitted BNB wallet address.

The Reality

Polkametaverse was created by the same individuals who created other fraudulent projects like DYDX.

"@polkametaverse claims audited by PeckShield, which is not true. The audit report posted on their website is forged."

What Happened

The Polkametaverse project was created by a fraudulent team with a number of false claims including listing on Binance. The website included a fake smart contract audit by Peckshield. Peckshield has denied auditing the project.

Key Event Timeline - PolkaMetaverse Fake Audit

Date	Event	Description
January 11th, 2022 2:49:59 PM MST	Promotional Tweet	Polkametaverse tweets to promote their airdrop.
January 12th, 2022 10:56:29 AM MST	Promotional Tweet	Polkametaverse tweets to promote their airdrop.
January 15th, 2022 3:34:00 PM MST	PeckShield Reports Fraudulent Audit	Peckshield posts a tweet reporting that the smart contract audit is not true.

Technical Details

This section includes specific detailed technical analysis of any security breaches which happened. What specific software vulnerabilities contributed to the problem and how were they exploited?

Total Amount Lost

The total amount lost is unknown.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

TBD

#ScamAlert We notice that a project named so-called @polkametaverse claims audited by PeckShield, which is not true. The audit report posted on their website is forged. Thanks!

Ultimate Outcome

TBD

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

TBD

Individual Prevention Policies

Third party audits should be verified at the source. Almost all smart contract auditing services publish their audits online.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

The risk in a smart contract can be reduced by storing most funds offline, and only bringing those assets needed for the specific transaction.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

Policies for platforms to take to prevent this situation have not yet been selected in this case.

Never take for granted the limited knowledge of users of your service and their tendency to skip past provided information. It is recommended to design a simple tutorial and quiz for new users which explains the basics of seed phrases, strong password generation, secure two-factor authentication, common fraud schemes, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space. This tutorial and quiz should ensure their understanding and be a standard part of the sign-up or download process which is difficult or impossible to skip.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

No specific regulatory policies have yet been identified in this case.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.