Gold Mine Finance Scam

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!

Gold Mine Finance was a new protocol on the Fantom blockchain, a fork of Tomb Finance. There were no documents or website for the fork. It was promoted solely on Twitter and some listing sites. The smart contract hot wallet had a clever vulnerability present to enable the removal of liquidity. Although $800k of liquidity was originally present in the protocol, $700k was removed after RugDoc announced the vulnerability. The end losses were just $68k.

This is a global/international case not involving a specific country.

About Gold Mine Finance

"New Tomb fork on FTM."

The Reality

"No docs. Farms to earn the shares token & Boardroom for bonding token launches today. There is no information on the supply of the shares token, epoch length, expansion rate, etc. GoldMine is the algostable, pegged to the price of USDC. No information on the name of the Shares and Bonding token." "No website yet, I’m linking you to their Twitter."

"Do NOT stake in Gold Mine Finance on #Fantom."

"The genesis launched 17 minutes ago, verified 15 minutes ago contains a clever hard rug that WILL BE PULLED."

"$800k already staked and likely will be lost."

"Rugdoc.io tweeted that the Fantom ecological project Gold Mine Finance has rug pull."

What Happened

Gold Mine Finance launched a Fantom-based smart contract which included code enabling a rug pull.

Key Event Timeline - Gold Mine Finance Scam

Date	Event	Description
February 18th, 2022 11:17:00 AM MST	Rug Doc Provides Warning	Rug Doc announces that the freshly launched Gold Mine Finance smart contract "contains a clever hard rug that WILL BE PULLED". "$800k already staked and likely will be lost."
February 18th, 2022 11:28:00 AM MST	RugDocIO Provides Summary	RugDocIO provides a summary of what happened on Twitter. They confirm that over $700k worth of liquidity was able to pull out of the protocol based on their warning.
February 18th, 2022 11:43:00 AM MST	Final Hard Rug Tally Published

Technical Details

<-- TBD link to technical analysis from Rug Doc.

"[W]hen adjusting the pool reward weights, the poolEndTimes are shifted. However, they are shifted 2 months in the past because the clever rugger used PoolStartTime within the first endTime." "Within the common recovery method, which can usually only be used to take out tokens when genesis has long ended, the recovery can occur 30 days after."

"Within minutes of our previous announcement, $700k of TVL monitoring rugdoc closely was able to get out! That's CRAZY." "Final Hard Rug Tally: 22688 DAI, 16893 FTM, 3153.2 TOMB, 14522 USDC Total ~$74,800 USD Over 91% were able to escape before they stole everything."

"Rugdoc.io tweeted that the Fantom ecological project Gold Mine Finance has rug pull."

List of hard rug transactions: https://ftmscan.com/tx/0xefc7d7211b842c85d116c93f4665d9ab49e74222f9130c1ba849009915d09a22… https://ftmscan.com/tx/0xf2755d043b337397d0b1a7b0fa2865dc59da513d4d4a1e3807ade45847a36433… https://ftmscan.com/tx/0x57944bfb375f9a6d0ce8534c680420dd7e379d65bc9ff96f0989f850819fe4ef… https://ftmscan.com/tx/0xebecdfa8ad1445acfcce67e2e2871ed6829da007326577888c858b4d0e3e70e0… https://ftmscan.com/tx/0x75584e5649bfa5045f94c3d2fa88ae4da243822fca69b5d1e4e89070a9756b52… https://ftmscan.com/tx/0x2701cc222ca3ce1db94341f08e1361275fb66387ddd3f4d8bc8651feb2ad5336… https://ftmscan.com/tx/0xc238cc24369fb9f38f180adda19262d3694680825570b4fcd079ef7d683344b1… https://ftmscan.com/tx/0xdb61044d496bd155e0258b738f537cdee5f7f1772f4106a96f0b864277769897

Total Amount Lost

The total amount at risk has been estimated at $800,000 USD. The total amount lost has been estimated at $68,000 USD.

Final Hard Rug Tally: 22688 DAI, 16893 FTM, 3153.2 TOMB, 14522 USDC Total ~$74,800 USD

Immediate Reactions

"February 18 update – RugDoc reported the genesis pools contain hard rug code. Their Twitter was deleted."

Ultimate Outcome

Updates and analysis were shared after the rug pull happened.

Update From Rug Doctor

Rug Doctor shared an update on the rug pull after it happened.

GoldMine Finance Update

GoldMine Finance has quickly pulled the rug after discovery.

Rugger: https://ftmscan.com/address/0xe0e02e88adb4d4eaa5cb2952842cd3c76571831a…

TVL stolen: $68,320 Within minutes of our previous announcement, $700k of TVL monitoring rugdoc closely was able to get out!

That's CRAZY

Our condolences to the remaining 10% who wasn't able to withdraw in time. We are genuinely sorry for you.

For the $700k that was able to withdraw from this after the announcement. Rugdoc is a community led DeFi watchdog that aims to make DeFi safer.

All though not expected, donations to further scale up our operation are always appreciated

Be safe out there!

Community Reactions

"You're doing a fantastic job! Well done! How do you monitor all these farms? Do you have smart contract alerts set up?"

"What a call was awesome too see investors pull out funds quickly after u called that! Almost saw someone lose 55k ftm but pulled out before they could rug!"

"quality work from the rugdoc team!"

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

TBD

Individual Prevention Policies

The Gold Mine Finance smart contract contained a vulnerability which would have been easily discovered by any smart contract audit. Special care needs to be taken to ensure that users are only interacting with safe smart contracts.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

Keeping the majority of funds offline would minimize the risk and potential loss from any smart contract issue.

Store the majority of funds offline. By offline, it means that the private key and/or seed phrase is exclusively held by you and not connected to any networked device. Examples of offline storage include paper wallets (seed phrase or key written down and deleted from all electronic media), hardware wallets, steel wallet devices, etc...

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

While it is uncertain whether the Gold Mine Finance project was run by a single individual or a group, a group can protect themselves against a rogue member by ensuring that all aspects of the smart contract are protected through a multi-signature requirement. Having a third party validation can ensure that no back doors have been left in the smart contract.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

The primary issue is around education of the risks and how to use smart contracts safely.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

These types of rug pulls are easy to detect by any experienced reviewer.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

An industry insurance fund may act to assist users who fell victim.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.