Bogged Finance Emptying

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' section to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

Bogged Finance

Another breach of a liquidity pool. In this case, the exploit was stopped part-way through draining the funds.

The team plans to relaunch. There is some concern over dilution of the token supply in their new plan. They seem optimistic given the large number of people following the project. However, it's really unclear if people coming after seeing the hack will be enthusiastic investors.

This is a global/international case not involving a specific country.

About Bogged Finance

"The Bogged.Finance Platform allows you to research and place orders for any token on Binance Smart Chain." "Our Limit Order platform takes advantage of PancakeSwap's Liquidity, in the future the platform will take advantage of multiple Decentralised Exchanges, allowing your order to be filled at the best possible price." "You can view charts for any token with liquidity in PancakeSwap for free with Bogged Finance's Charts. This includes vital information such as liquidity and marketcap. Updates and improvements to the chart platform will continue to be rolled out in the coming weeks and months."

"Bogged Finance is a token which runs code each time it is executed for various use-cases, including real-time and historical decentralised oracles on Binance Smart Chain."

"Binance Smart Chain protocol Bogged Finance has lost a whopping $3 million of its native token $BOG." "$3 million worth of funds w[ere] drained from its liquidity pool on PancakeSwap." "Of note, the $3 million lost represents almost half of Bogged Finance’s total liquidity." "The $BOG token was exploited by an unknown attacker who was able to drain $3m of the $6m liquidity using a complex Flash-Loan based attack." "In a post mortem published on May 23, security firm PeckShield detailed the attack that resulted in a malicious actor making off with $3.6 million."

"We are aware of the flash loan attack against BOG and are as devastated as you. We believe we have prevented further theft against more of our liquidity."

"The old $BOG token was exploited due to a flaw in the staking portion of the token contract, which allowed a hacker to inflate the supply and dump the tokens on the market." "As reported by PeckShield, the incident happened through the exploitation of a bug in the BOG token contract. The contract in reality has been designed to be deflationary in nature by charging 5% of the transferred amount. Of this 5%, 1% is burned and the remaining 4% is taken as a fee for staking charges."

"At the same time, the token contract implementation only charges 1% of the transferred amount but still inflates the 4% as the staking profit. The blog post notes:"

“As a result, the attacker can take advantage of flashloans to significantly increase the staking amount and repeatedly perform self-transfers to claim the inflated staking profit. After that, the attacker immediately sells the inflated BOG for about $3.6M WBNB”.

"This has been rectified in version 2 of the $BOG contract, and $BOG and BogTools is ready to come back stronger than ever. We have completed an audit with a third party and will get additional audits done post-launch."

"The Bogged Finance Token Migration is taking longer than expected. The funds are being held securely in this wallet, until redeployment is complete. We are excited to launch the new version of the BOG Contract with over 7.5 million tokens burned. We will announce a countdown for the relaunch before launch."

"The $BOG token will be relaunched at 9PM UTC on June 1st 2021, in under 15 hours from this post going live." "Currently, tokens are being airdropped via the bogged.finance platform to pre-snapshot holders, and trading will be re-enabled at 9PM UTC. The interest in $BOG is immense and we’re excited to continue to build $BOG and the Bogged.Finance platform." "BOG will launch approximately 70% below its all-time high market cap. Original pre-exploit holders were diluted by approximately 3–3.5x."

"We have had incredible interest in the relaunch of BOG, with our telegram exploding to almost 25,000 members. In terms of marketing, we have activated a massive banner on the charts platform which is being seen by hundreds of thousands of people per day — inviting them to the relaunch of $BOG. In addition, we will be activating marketing with a variety of partners pre and post-launch." "BOG is a long-term project and we are here to stay, we will not be rushing this migration."

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

Known history of when and how the service was started.
What problems does the company or service claim to solve?
What marketing materials were used by the firm or business?
Audits performed, and excerpts that may have been included.
Business registration documents shown (fake or legitimate).
How were people recruited to participate?
Public warnings and announcements prior to the event.

Don't Include:

Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

When the service was actually started (if different than the "official story").
Who actually ran a service and their own personal history.
How the service was structured behind the scenes. (For example, there was no "trading bot".)
Details of what audits reported and how vulnerabilities were missed during auditing.

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - Bogged Finance Emptying
Date	Event	Description
May 23rd, 2021 12:00:00 AM	Main Event	Expand this into a brief description of what happened and the impact. If multiple lines are necessary, add them here.

Total Amount Lost

The total amount lost has been estimated at $3,600,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

The total amount recovered has been estimated at $0 USD.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Prevention Policies

While decentralized finance continues to improve in security over time by learning from incidents like these, it remains that air-gapped storage held by a multi-sig of reputable individuals is a far more secure method of storage.