SudoRare NFT Market Maker Rug Pull

Notice: This page is a new case study and some aspects have not been fully researched. Some sections may be incomplete or reflect inaccuracies present in initial sources. Please check the References at the bottom for further information and perform your own additional assessment. Please feel free to contribute by adding any missing information or sources you come across. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.

SudoRare

SudoRare claimed to be a new and more efficient automated market maker, combining together code from popular platforms LooksRare and SudoSwap. They ran a large airdrop which was a reward for anyone staking in their pool, which was a modified (upgradable) version of the popular market making protocol Master Chef. The community started to become suspicious later in the process, but that didn't stop almost a million dollars worth of funds from being deposited into the staking pool and ultimately stolen from the smart contract.

All social media of the project was removed and it doesn't appear that any recovery has been undertaken at the moment.

About SudoRare

"Sudorare was a fork of decentralized NFT marketplace SudoSwap, known for its liquidity pools for NFTs and cheaper gas fees, and LooksRare (LOOKS), another NFT marketplace that rewards users for their participation on the platform. Both projects have gained popularity among crypto circles in the past year." "SudoRare was an automated market maker platform and NFT marketplace, advertising staking opportunities for assets like Wrapped Ethereum (wETH), LOOKS, and XMON. LOOKS is the native token behind LooksRare, itself a fork of the leading NFT marketplace OpenSea."

"The SudoRare AMM is a UX/UI improved, gas-efficient AMM protocol for facilitating ERC721s to ERC20 swaps with better tokenomics on top of it." "SudoRare[ was] an NFT platform that forked from SudoSwap and LooksRare." "[W]e’re merging the Sudoswap features with the LooksRare staking mechanism. We didn’t create something 100% new, we’re just trying to make something better on top of existing protocols." "We hear out what the community told us during the early days. We remastered the Genesis pools." "And potentially airdropping/rewarding early users!"

"Tokenomics: Total supply 100M [SudoRare tokens], 89M [SudoRare tokens] distributed through farming pools, 8M [SudoRare tokens] for liquidity and airdrop[, and] 3M [SudoRare tokens] vested for the team over 2 years (unlocks every month)." "An $SR airdrop will take place at the end of the genesis phase for people who took part in the “am I early?” phase AND staked tokens in at least one genesis pools. We will verify this through your “Early ID” which is the address you used to connect wallet and tweet."

"You will be able to stake your $SR tokens to earn $ETH from the platform trading fees (0.5% on each swap). The product will be live as soon as the LP staking ends." "After the first genesis pools farming phase (3 days), another farming pool will open: SR/ETH. This LP will be incentivized with better rewards in terms of $SR and will also last 3 days."

"To bootstrap our Treasury a 1% deposit fee will be settled on the single sided pools ($XMON $LOOKS and $ETH). However, this fee will not apply for those staking in the SR/ETH pool. The team also plans to fund the SR/ETH pool WITHOUT farming $SR with our OWN personal funds."

"For people who took part in the “am I early?” phase AND staked tokens in at least one genesis pools. We will verify this through your @SudoRare “Early ID” which is the address you used to connect wallet and tweet." "If you've followed my thread (see post below) on the 'Am I early' phase, you simply have to wait for the launch and stake tokens in at least one of the pools in order to be eligible for the airdrop."

"Keep in mind that SudoRare is an EXPERIMENTAL project." "BE AWARE: TEAM IS ANON, PROCEED WITH CAUTION. NO FINANCIAL ADVICE."

SudoRare Homepage:

SudoRare Twitter:

The Reality

Rug pulls have happened repeatedly with new projects in the cryptocurrency space.

There was much skepticism among the cryptocurrency community.

While Twitter user 2shabby had previously announced and supported the project and also assisted users in joining, he had also posted multiple warnings throughout.

Multiple other users had suggested that the project may be a scam including Adam with Twitter handle surfcoderepeat. (TBD expand on )

sudo rare is live but ppl staking into an upgradeable contract that points to a fork of master chef.

Can't see any reason to need an upgradeable version of Masterchef as it's really battle tested already

stay safe as could be a scam.

This Is like 1001% scam project that noobs will fall for it. Nature is healing

"The Sudo[R]are team is fully anon[ymous] and will never dox. I don't know who they are and whether their intentions are good or not." “Don’t participate unless you want to take the risk of losing your money. This team is [anonymous], won’t [disclose their identities], and the possibility of this being a scam is high.”

Another Twitter user 0xStanec had a high degree of suspicion, saying, “This Is like a 1,001% scam project that noobs will fall for it.” Twitter user surfcoderepeat reported "[SudoRare] is live but [people are] staking into an upgradeable contract that points to a fork of master chef. [I c]an't see any reason to need an upgradeable version of Masterchef as it's really battle tested already[. S]tay safe as [this] could be a scam."

"[T]his is already scam almost $1M. [S]o sad for [those] who got involved."

What Happened

SudoRare "ran off with Ξ519 (~$815,000) of user funds and deleted all of its social media accounts on Aug. 23."

Key Event Timeline - SudoRare NFT Market Maker Rug Pull

Date	Event	Description
August 17th, 2022 1:07:00 AM MDT	Shabby's Initial Project Promotion	Twitter user 2shabby first mentions the project as "a UX/UI improved, gas-efficient AMM protocol for facilitating ERC721s to ERC20 swaps with better tokenomics on top of it".
August 17th, 2022 1:10:00 AM MDT	Shabby's First Warning	Twitter user 2shabby responds to his thread also including that the team is fully anonymous and recommending users to do their own research.
August 20th, 2022 5:01:05 PM MDT	SudoRare Project Announced	The SudoRare NFT project is announced on Medium.
August 21st, 2022 6:53:00 AM MDT	Shabby Posts More In Support of Project	Twitter user 2shabby posts a thread promoting the SudoRare NFT project on Twitter.
August 21st, 2022 7:06:00 AM MDT	TrycVerse Asks About Requirements	Twitter user TrycVerse posts asking for what's required to get the air drop.
August 22nd, 2022 1:19:00 AM MDT	Shabby Posts Warning	Twitter user 2shabby posts a warning about the project on Twitter.
August 22nd, 2022 8:30:00 PM MDT	Supposed SudoRare Launch Date	The previously announced launch date of the SudoRare NFT project.
August 22nd, 2022 8:41:00 PM MDT	User Enquiries About Scam	Twitter user dotta asks if the project was a scam. At this time, the account was still active, but the launch time had passed.
August 23rd, 2022 12:01:40 AM MDT	Ethereum Transaction Draining Funds	The Ethereum blockchain transaction occurs which is draining the funds.
August 23rd, 2022 12:03:00 AM MDT	sungjae_han Tweet About Rug Pull	Twitter user sungjae_han reports the rug pull, stating it "seems like sudorare rugged for 800k".
August 23rd, 2022 12:18:00 AM MDT	Twitter Account Reported Missing	The SudoRare Twitter account had been deleted. Twitter user amb_upe posts a screenshot of the Twitter account @SudoRare having disappeared from the platform.
August 23rd, 2022 12:44:00 AM MDT	PeckShield Alert Posted	PeckShield posts an alert on Twitter. They also report that "[s]tole[n] funds [have] already [been] transferred to 3 new addresses".
August 23rd, 2022 3:56:22 AM MDT	CoinDesk Article Published	CoinDesk publishes an article on the SudoRare project's rug pull, reporting that developers behind the non-fungible token (NFT) platform Sudorare scammed users for over $800,000 in various cryptocurrencies before deleting the project's online presence. Sudorare, a fork of decentralized NFT marketplace SudoSwap and LooksRare, offered a yield farm where users could stake LOOKs, XMON, and wETH for its own tokens. However, just six hours after the liquidity pool went live, Sudorare developers emptied it, stealing over 514 ether, equivalent to $815,000 at current rates. Despite warnings on Crypto Twitter about the project's risks, users fell victim to the rug pull. Rug pulls involve draining liquidity pools, causing a significant drop in related tokens.
August 23rd, 2022 5:00:00 AM MDT	Funds Traced To Kraken	Blockchain analytics firm PeckShield reports that they traced funds to the cryptocurrency exchange Kraken.
August 23rd, 2022 5:09:00 AM MDT	We're Gonna Make It	Members of the community-lead WGMI (We're Gonna Make It) movement reach out to affected users of the SudoRare rug pull.
August 23rd, 2022 5:12:31 AM MDT	The Block Article Published	The Block reports that SudoRare, a decentralized NFT exchange, experienced a rug pull just six hours after its launch, resulting in the disappearance of tokens worth over $800,000 from the platform's wallet address. The rug pull involved draining 519 ETH, LooksRare (LOOKS), and USD Coin (USDC) tokens. The funds were sent to three different wallets, with one of them belonging to a user of the Kraken crypto exchange. The abrupt disappearance of the funds and the deletion of social media accounts and websites indicate a potential scam by the project's founders. SudoRare, a combination of SudoSwap and LooksRare, aimed to offer a decentralized exchange for NFTs with liquidity pools and rewards for users.
August 23rd, 2022 5:15:00 AM MDT	azerotravel Loss Summary	Twitter user azerotravel reports on the losses as "almost $1M".
August 23rd, 2022 9:43:19 AM MDT	Decrypt Article Published	Decrypto publishes an article about the situation. TBD Expand on article.
August 23rd, 2022 9:55:02 AM MDT	CryptoPotato Article Published	CryptoPotato reports that SudoRare rug-pulled its customers just six hours after its launch, making away with over $850,000 in ETH, LooksRare (LOOKS), and USD Coin (USDC). The blockchain security company PeckShield revealed that the attackers sent the drained funds to three different wallets, each receiving 173 ETH. One of the crypto addresses involved in the attack is registered at Kraken, a regulated cryptocurrency exchange. SudoRare's team deleted all content from Twitter and the official website after the rug pull. There were prior warnings in the crypto community about the project being potentially fraudulent, citing an anonymous team and unrealistic promises of returns.
August 23rd, 2022 10:22:05 AM MDT	CryptoBriefing Article On Kraken	A CryptoBriefing article reports that the team behind decentralized NFT exchange SudoRare pulled off a rug pull, stealing $820,000 from the community before disappearing. Blockchain data indicates that one of the attackers may have interacted with Kraken, a regulated cryptocurrency exchange, in the past. An Ethereum wallet funded through Kraken on August 21 was involved in the attack. If the wallet belongs to a member of the SudoRare team, Kraken, in compliance with U.S. regulations, may have details on their real identity. Possible scenarios for Kraken include revealing the attacker's identity, freezing any funds they have on the exchange, or passing details to law enforcement for a criminal investigation.
August 23rd, 2022 5:44:00 PM MDT	Web3IsGoingGreat	Web3IsGoingGreat includes a tweet and article about the SudoRare rug pull.

Technical Details

SudoRare "ran off with Ξ519 (~$815,000) of user funds and deleted all of its social media accounts on Aug. 23."

"Funds were sent to three different addresses to drain both the funds, with any trace of the project removed, according to PeckShieldAlert on Twitter." "SudoRare already deleted its social accounts/groups, sudorare[.]xyz is down."

"Six hours after going live, almost 1 million LOOKS tokens were swapped into 154.5 Ethereum and another 230.6 LOOKS tokens into USD Coin (USDC), confirmed on Etherscan." "Sudorare developers illicitly emptied the LOOKS liquidity pool just six hours after it went live, swapping over 1 million LOOKS for 154 ether and 60,000 USDC in one such transaction, and thus pulling off a colloquial “rug pull.” The developers stole over 514 ether in all, valued at just over $815,000 at current rates."

Total Amount Lost

SudoRare "ran off with Ξ519 (~$815,000) of user funds and deleted all of its social media accounts on Aug. 23."

Twitter user azerotracel described the losses as "almost $1M".

The total amount lost has been estimated at $816,000 USD.

How much was lost and how was it calculated? If there are conflicting reports, which are accurate and where does the discrepancy lie?

Immediate Reactions

How did the various parties involved (firm, platform, management, and/or affected individual(s)) deal with the events? Were services shut down? Were announcements made? Were groups formed?

Deleted Twitter Account:

"Funds were sent to three different addresses to drain both the funds, with any trace of the project removed, according to PeckShieldAlert on Twitter." "SudoRare already deleted its social accounts/groups, sudorare[.]xyz is down."

Twitter Reactions

Multiple Twitter users responded to the events.

this is already scam almost $1M. so sad for who got involved

Sadly sudorare was an obvious rug. Especially at launch. Luckily the damage was relatively small. But can someone make a real xmon farm? That would be fun

Another rug pull and this time it's an NFT AMM protocol built by a fully anon team...

In light of the latest Sudorare event, SeaCows NFT, another decentralized NFT AMM platform, tweeted: “This sucks. Do your own research and hold teams to high security and transparency standards.”

We're Gonna Make It

Members of the community-lead WGMI (We're Gonna Make It) movement have reach out to affected users of the SudoRare rug pull.

"Many in the Crypto Twitter community were skeptical, with 2shabby tweeting on Monday that https://twitter.com/thewgmimovement could be a scam."

Ultimate Outcome

Funds were traced on the blockchain, which showed that at least one of the assailants had previously interacted with the large North American exchange Kraken.

Tracing Of The Funds

"As blockchain security firm PeckShield noted Tuesday, at least one of the assailants appears to have interacted with Kraken in the past. Etherscan data shows that an Ethereum wallet commencing 0x814 was funded through Kraken on August 21. That wallet transferred 0.28 ETH to 0xbb4 earlier today, hours before SudoRare withdrew $820,000 worth of WETH, XMON, and LOOKS and deleted its online channels. The 0xbb4 wallet was one of several addresses used during the attack, last seen transferring 173.1 ETH worth $283,000 at 06:37 UTC today. That suggests that the 0x814 Kraken-funded wallet may in fact belong to a member of the SudoRare team."

Kraken issued a public statement.

“While Kraken can’t comment directly on any specific request, like all compliant crypto exchanges, we report suspicious activity and respond to law enforcement requests. We even publish a transparency report that describes our extensive work with law enforcement. Last year alone, Kraken responded to 2,453 information requests from law enforcement agencies in the US, UK, and Europe—up 130% from 2020. We take our role as the facilitator of a safe trading environment incredibly seriously and we will continue to work with our partners in the fight against fraud.”

New User On Twitter Handle

It appears that someone else has subsequently set up an account on the same SudoRare Twitter handle.

Total Amount Recovered

There do not appear to have been any funds recovered in this case.

Ongoing Developments

TBD

Individual Prevention Policies

The SudoRare smart contract underwent no inspections or audits prior to launch, and multiple members of the community who had inspected the contract concluded that it may be a scam. The team installed a backdoor in the Master Chef smart contract which allowed them to steal all funds.

Avoid the use of smart contracts unless necessary. Minimize the level of exposure by removing or withdrawing assets whenever possible. Aim to choose smart contracts which have obtained third party security audits, preferably having been audited by at least three separate reputable firms. Pay attention to the audit reports, which smart contracts are covered, and whether the smart contract has been upgraded or modified since the report. Ensure that any administrative functions with the ability to remove funds from the smart contract are under the authority of a multi-signature wallet which is controlled by at least three separate and reputable entities.

For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.

Platform Prevention Policies

A primary issue was placing funds in the hands of a single individual who was able to then take them all.

All wallets, minting functions, and critical infrastructure should be implemented with a multi-signature requirement, with a recommended minimum of 3 signatures required. This means that making important changes or approving spending will require the keys held by at least 3 separate individuals within the organization to approve. The multi-signature should be implemented at the lowest layer possible, all key holders should have security training, and all key holders should be empowered and encouraged to exercise diligence.

Of course, multi-signature on it's own is not effective unless it can be confirmed that all three keys are held by independent trained individuals. Others within the organization (if any) should pressure to mandate this.

All aspects of any platform should undergo a regular validation/inspection by experts. This validation should include a security audit of any smart contracts, reporting any risks to the backing (of any customer assets, ensuring treasuries or minting functions are properly secured under the control of a multi-signature wallet, and finding any inadequacies in the level of training or integrity of the team. The recommended interval is twice prior to launch or significant system upgrade, once after 3 months, and every 6 months thereafter. It is recommended that the third party performing the inspection not be repeated within a 14 month period.

For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.

Regulatory Prevention Policies

One key issue is a lack of public education. There were multiple warning signs available prior to the project launching, and public members continued to place additional funds in the smart contract despite all the warnings.

Create a standard tutorial and quiz for all new cryptocurrency participants, which is required to be completed once per participant. This tutorial and quiz should cover the basics of proper seed phrase protection, strong password generation, secure two-factor authentication, common fraud schemes, how to detect and guard against phishing attacks, how ponzi schemes work, as well as other risks which are unique to the cryptocurrency space.

Multi-signature on it's own is not effective unless it can be confirmed that all three keys are held by independent and trained signatories. It would be recommended that all projects undergo multiple smart contract audits to confirm that there are no backdoors.

All platforms should undergo published security and risk assessments by independent third parties. Two assessments are required at founding or major upgrade, one after 3 months, and one every 6 months thereafter. The third parties must not repeat within the past 14 months. A risk assessment needs to include what assets back customer deposits and the risk of default from any third parties being lent to. The security assessment must include ensuring a proper multi-signature wallet, and that all signatories are properly trained. Assessments must be performed on social media, databases, and DNS security.

Failing this, an insurance fund can serve as a fallback. Unlike traditional forms of for-profit insurance, a collective industry insurance fund could have the discretion to cover victims of known frauds.

Set up a multi-signature wallet with private keys held separately by delegate signatories from seven prominent platforms and services within the industry. Establish requirements for contributions by all platforms and services within the country, designed to be affordable for small platforms yet large enough to cover anticipated breach events. Any breach event can be brought forth by a member platform or a petition of 100 signatures for consideration by the delegate signatories. A vote of 4 or more delegate signatures is required to release any funds, which could partially or fully restore lost funds based on their assessment.

For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.