SudoRare NFT Market Maker Rug Pull

Notice: This page is a freshly imported case study from the original repository. The original content was in a different format, and may not have relevant information for all sections. Please help restructure the content by moving information from the 'About' and 'General Prevention' sections to other sections, and add any missing information or sources you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

SudoRare

SudoRare claimed to be a new and more efficient automated market maker, combining together code from popular platforms LooksRare and SudoSwap. They ran a large airdrop which was a reward for anyone staking in their pool, which was a modified (upgradeable) version of popular market making protocol Master Chef. The community started to become suspicious later in the process, but that didn't stop almost a million dollars worth of funds from being deposited into the staking pool and ultimately stolen from the smart contract.

All social media of the project was removed and it doesn't appear that any recovery has been undertaken at the moment. It appears that someone else has subsequently set up an account on the same SudoRare Twitter handle.

About SudoRare

SudoRare Homepage:

SudoRare Twitter:

"Sudorare was a fork of decentralized NFT marketplace SudoSwap, known for its liquidity pools for NFTs and cheaper gas fees, and LooksRare (LOOKS), another NFT marketplace that rewards users for their participation on the platform. Both projects have gained popularity among crypto circles in the past year." "SudoRare was an automated market maker platform and NFT marketplace, advertising staking opportunities for assets like Wrapped Ethereum (wETH), LOOKS, and XMON. LOOKS is the native token behind LooksRare, itself a fork of the leading NFT marketplace OpenSea."

"The SudoRare AMM is a UX/UI improved, gas-efficient AMM protocol for facilitating ERC721s to ERC20 swaps with better tokenomics on top of it." "SudoRare[ was] an NFT platform that forked from SudoSwap and LooksRare." "[W]e’re merging the Sudoswap features with the LooksRare staking mechanism. We didn’t create something 100% new, we’re just trying to make something better on top of existing protocols." "We hear out what the community told us during the early days. We remastered the Genesis pools." "And potentially airdropping/rewarding early users!"

"Tokenomics: Total supply 100M [SudoRare tokens], 89M [SudoRare tokens] distributed through farming pools, 8M [SudoRare tokens] for liquidity and airdrop[, and] 3M [SudoRare tokens] vested for the team over 2 years (unlocks every month)." "An $SR airdrop will take place at the end of the genesis phase for people who took part in the “am I early?” phase AND staked tokens in at least one genesis pools. We will verify this through your “Early ID” which is the address you used to connect wallet and tweet."

"You will be able to stake your $SR tokens to earn $ETH from the platform trading fees (0.5% on each swap). The product will be live as soon as the LP staking ends." "After the first genesis pools farming phase (3 days), another farming pool will open: SR/ETH. This LP will be incentivized with better rewards in terms of $SR and will also last 3 days."

"To bootstrap our Treasury a 1% deposit fee will be settled on the single sided pools ($XMON $LOOKS and $ETH). However, this fee will not apply for those staking in the SR/ETH pool. The team also plans to fund the SR/ETH pool WITHOUT farming $SR with our OWN personal funds."

"For people who took part in the “am I early?” phase AND staked tokens in at least one genesis pools. We will verify this through your @SudoRare “Early ID” which is the address you used to connect wallet and tweet." "If you've followed my thread (see post below) on the 'Am I early' phase, you simply have to wait for the launch and stake tokens in at least one of the pools in order to be eligible for the airdrop."

"Keep in mind that SudoRare is an EXPERIMENTAL project." "BE AWARE: TEAM IS ANON, PROCEED WITH CAUTION. NO FINANCIAL ADVICE."

"Many in the Crypto Twitter community were skeptical, with 2shabby tweeting on Monday that https://twitter.com/thewgmimovement could be a scam." "The Sudo[R]are team is fully anon[ymous] and will never dox. I don't know who they are and whether their intentions are good or not." “Don’t participate unless you want to take the risk of losing your money. This team is [anonymous], won’t [disclose their identities], and the possibility of this being a scam is high.”

Another Twitter user 0xStanec had a high degree of suspicion, saying, “This Is like a 1,001% scam project that noobs will fall for it.” Twitter user surfcoderepeat reported "[SudoRare] is live but [people are] staking into an upgradeable contract that points to a fork of master chef. [I c]an't see any reason to need an upgradeable version of Masterchef as it's really battle tested already[. S]tay safe as [this] could be a scam."

"[T]his is already scam almost $1M. [S]o sad for [those] who got involved."

SudoRare "ran off with Ξ519 (~$815,000) of user funds and deleted all of its social media accounts on Aug. 23."

"Six hours after going live, almost 1 million LOOKS tokens were swapped into 154.5 Ethereum and another 230.6 LOOKS tokens into USD Coin (USDC), confirmed on Etherscan." "Sudorare developers illicitly emptied the LOOKS liquidity pool just six hours after it went live, swapping over 1 million LOOKS for 154 ether and 60,000 USDC in one such transaction, and thus pulling off a colloquial “rug pull.” The developers stole over 514 ether in all, valued at just over $815,000 at current rates."

"Funds were sent to three different addresses to drain both the funds, with any trace of the project removed, according to PeckShieldAlert on Twitter." "SudoRare already deleted its social accounts/groups, sudorare[.]xyz is down."

In light of the latest Sudorare event, SeaCows NFT, another decentralized NFT AMM platform, tweeted: “This sucks. Do your own research and hold teams to high security and transparency standards.”

This is a global/international case not involving a specific country.

The background of the exchange platform, service, or individuals involved, as it would have been seen or understood at the time of the events.

Include:

• Known history of when and how the service was started.
• What problems does the company or service claim to solve?
• What marketing materials were used by the firm or business?
• Audits performed, and excerpts that may have been included.
• Business registration documents shown (fake or legitimate).
• How were people recruited to participate?
• Public warnings and announcements prior to the event.

Don't Include:

• Any wording which directly states or implies that the business is/was illegitimate, or that a vulnerability existed.
• Anything that wasn't reasonably knowable at the time of the event.

There could be more than one section here. If the same platform is involved with multiple incidents, then it can be linked to a main article page.

The Reality

This sections is included if a case involved deception or information that was unknown at the time. Examples include:

• When the service was actually started (if different than the "official story").
• Who actually ran a service and their own personal history.
• How the service was structured behind the scenes. (For example, there was no "trading bot".)
• Details of what audits reported and how vulnerabilities were missed during auditing.

While Twitter user 2shabby had previously announced and supported the project and also assisted users in joining, he had also posted multiple warnings throughout.

Multiple other users had suggested that the project may be a scam including Adam with Twitter handle surfcoderepeat. (TBD expand on )

sudo rare is live but ppl staking into an upgradeable contract that points to a fork of master chef.

Can't see any reason to need an upgradeable version of Masterchef as it's really battle tested already

stay safe as could be a scam.

This Is like 1001% scam project that noobs will fall for it. Nature is healing

What Happened

The specific events of the loss and how it came about. What actually happened to cause the loss and some of the events leading up to it.

Key Event Timeline - SudoRare NFT Market Maker Rug Pull

Date	Event	Description
August 17th, 2022 1:07:00 AM MDT	Shabby's Initial Project Promotion	Twitter user 2shabby first mentions the project as "a UX/UI improved, gas-efficient AMM protocol for facilitating ERC721s to ERC20 swaps with better tokenomics on top of it".
August 17th, 2022 1:10:00 AM MDT	Shabby's First Warning	Twitter user 2shabby responds to his thread also including that the team is fully anonymous and recommending users to do their own research.
August 20th, 2022 5:01:05 PM MDT	SudoRare Project Announced	The SudoRare NFT project is announced on Medium.
August 21st, 2022 6:53:00 AM MDT	Shabby Posts More In Support of Project	Twitter user 2shabby posts a thread promoting the SudoRare NFT project on Twitter.
August 21st, 2022 7:06:00 AM MDT	TrycVerse Asks About Requirements	Twitter user TrycVerse posts asking for what's required to get the air drop.
August 22nd, 2022 1:19:00 AM MDT	Shabby Posts Warning	Twitter user 2shabby posts a warning about the project on Twitter.
August 22nd, 2022 8:30:00 PM MDT	Supposed SudoRare Launch Date	The previously announced launch date of the SudoRare NFT project.
August 22nd, 2022 8:41:00 PM MDT	User Enquiries About Scam	Twitter user dotta asks if the project was a scam. At this time, the account was still active, but the launch time had passed.
August 23rd, 2022 12:01:40 AM MDT	Ethereum Transaction Draining Funds	The Ethereum blockchain transaction occurs which is draining the funds.
August 23rd, 2022 12:03:00 AM MDT	sungjae_han Tweet About Rug Pull	Twitter user sungjae_han reports the rug pull.
August 23rd, 2022 12:18:00 AM MDT	Twitter Account Reported Missing	The SudoRare Twitter account had been deleted. Twitter user amb_upe posts a screenshot of the Twitter account @SudoRare having disappeared from the platform.
August 23rd, 2022 12:44:00 AM MDT	PeckShield Alert Posted	PeckShield posts an alert on Twitter.
August 23rd, 2022 3:56:22 AM MDT	CoinDesk Article Published	CoinDesk publishes an article on the SudoRare project's rug pull.
August 23rd, 2022 5:15:00 AM MDT	azerotravel Loss Summary	Twitter user azerotravel reports on the losses as "almost $1M".
August 23rd, 2022 9:43:19 AM MDT	Decrypt Article Published	Decrypto publishes an article about the situation. TBD Expand on article.

Total Amount Lost

Twitter user azerotracel described the losses as "almost $1M".

The total amount lost has been estimated at $816,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Deleted Twitter Account:

Twitter Reactions

Multiple Twitter users responded to the events.

this is already scam almost $1M. so sad for who got involved

Sadly sudorare was an obvious rug. Especially at launch. Luckily the damage was relatively small. But can someone make a real xmon farm? That would be fun

Another rug pull and this time it's an NFT AMM protocol built by a fully anon team...

Ultimate Outcome

What was the end result? Was any investigation done? Were any individuals prosecuted? Was there a lawsuit? Was any tracing done?

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

What funds were recovered? What funds were reimbursed for those affected users?

Ongoing Developments

What parts of this case are still remaining to be concluded?

Individual Prevention Policies

The SudoRare smart contract underwent no inspections or audits prior to launch, and multiple members of the community who had inspected the contract concluded that it may be a scam. The team installed a backdoor in the Master Chef smart contract which allowed them to steal all funds.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

The primary issue was funds in the hands of a single individual who was able to then take them all.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

Of course, multi-signature on it's own is not effective unless it can be confirmed that all three keys are held by independent trained individuals. Others within the organization (if any) should pressure to mandate this.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

One of the primary issues is a lack of public education. There were multiple warning signs available prior to the project launching, and public members continued to place additional funds in the smart contract despite all the warnings.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

Multi-signature on it's own is not effective unless it can be confirmed that all three keys are held by independent and trained signatories. It would be recommended that all projects undergo multiple smart contract audits to confirm that there are no backdoors.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Failing this, an insurance fund can serve as a fallback. Unlike traditional forms of for-profit insurance, a collective industry insurance fund could have the discretion to cover victims of known frauds.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.