Rug Pull occurred on another Arbitrum public chain project, involving an amount of about 3 million US dollars

The main reason for this attack is that the Swaprum project party used the function of the proxy contract to switch the implementation contract, and switched the normal implementation contract to the implementation contract with the backdoor function, so that the backdoor function stole the liquid assets mortgaged by the user.

Written by: Beosin

On May 19, 2022, according to the Beosin-EagleEye situational awareness platform, the Swaprum project on the **Arbitrum public chain project was suspected to be a Rug Pull, involving an amount of about 3 million US dollars. **

The Beosin security team analyzed the incident for the first time and discovered that there was a backdoor in the liquidity mortgage reward pool deployed by the project party. The project party (Swaprum: Deployer) used the add() backdoor function to steal the liquidity of user mortgages Tokens, in order to achieve the purpose of removing the liquidity of the trading pool for profit. **

Event related information

Attack transactions (due to the existence of a large number of attack transactions, only some of them are shown here)

Attacker Address

0xf2744e1fe488748e6a550677670265f664d96627**（Swaprum: Deployer）**

Vulnerable contract

0x2b6dec18e8e4def679b2e52e628b14751f2f66bc

（TransparentUpgradeableProxy Contract）

0xcb65D65311838C72e35499Cc4171985c8C47D0FC

（Implementation Contract）

Attack process

For the sake of convenience, let's take two of the transactions as examples:

Call the add backdoor function to steal liquidity tokens)

Remove liquidity profit)

1. The Swaprum project party (Swaprum: Deployer) steals the liquidity tokens pledged by users in the TransparentUpgradeableProxy contract by calling the add() backdoor function of the TransparentUpgradeableProxy contract.

2. After decompiling the implementation contract, there is indeed a backdoor in the add() function. The backdoor function will transfer the liquidity tokens in the contract to the _devadd address [by querying the _devadd address, the address will be returned as the address of the Swaprum project party (Swaprum: Deployer)].

3. The Swaprum project party (Swaprum: Deployer) uses the stolen liquidity tokens in the first step to remove the liquidity tokens to obtain a lot of benefits.

4. It is worth noting that there is no loophole in the original liquidity mortgage contract of the project party, but the normal liquidity mortgage reward contract

(

Replaced with a backdoored liquidity staking rewards contract

(

Vulnerability Analysis

The main reason for this attack is that the **Swaprum project party used the function of the proxy contract to switch the implementation contract, and switched the normal implementation contract to the implementation contract with the backdoor function, so that the backdoor function stole the liquid assets mortgaged by the user. **

Funds Tracking

As of the time of publication, the Beosin KYT anti-money laundering analysis platform found that about 1,628 ETH (approximately US$3 million) of stolen funds had been cross-chained to Ethereum, and 1,620 ETH had been deposited into Tornado Cash.