Dec 27, 2022
EXCLUSIVE: THE DEFROST TEAM RUG PULLED $12M + $7M
We spent 2 years on creating the Largest Crypto Hacks Database with more than 3,160 hacks being added and manually verified by our on-chain researchers and solidity engineers. Our on-chain investigations have been mentioned by Forbes, Bloomberg, Wall Street Journal, and Blockworks.
We thought that we had already seen every type of Rug Pull and Scam possible.
But then Defrost Finance happened. And decided to make a little Christmas gift for its Community — rug pull them for $12M.
The way they have done this might be the most sneaky way to rug pull users that DeFi has ever seen.
How it started:
On December 24th, the World has seen the following tweet by Defrost Finance:
Defrost claimed that their V2 smart contract was exploited, and that attacker used a flash loan to withdraw funds.
However, the V1 contracts had been hacked as well resulting in the $12M loss. The oracle address in the protocol’s collateral vaults was replaced with a malicious one. That triggered liquidations of collateralized user funds.
0x3cd5854fe3a13707b7882d8290d3cae793a7751a — the Address that called setOracleAddress() was added as the Origin address by deployment of the DefrostFactory address:
The creator of the multisig wallet, which has to approve the oracle replacement function before it executes, is the same address that requested the oracle replacements:
This is an application for signing the oracle replacement by the multisig:
Addresses that were signing oracle replacements in the protocol’s vaults are:
- 0xF40D59331DCEf16a5E6C4f2E5BCC2cA968DeA619
- 0xEBbE39e3003013753a0109594b9451bcDe625bB7
- 0xbE22766FDd63d4acc60E6c209ef2eAE6DBFC4814
This is one of the oracle replacement transactions:
🚨 Connection of all the above mentioned addresses points out the hack was an insider job! 🚨
The funny part?
Exactly 1 month before rug pulling its users using the oracle vulnerability, Defrost Finance has insured themselves with 2 Crypto Insurance Providers: Insurace and Degis Insurance … against “Oracle Failure”.
What a coincidence! 🤦♂️
Now is where things are getting interesting.
So, back to DeFrost. Just as we did previously with Bundles, YFFS, PancakeBunny, Deus, and Alpha Homora cases - we are writing this article to inform the Community about the concerns we have about this project. As a premise, we would directly say that it seems like they are hiding.
But let’s start from the beginning.
Since 2020, we at DeFiYield.App, have performed more than 60+ Security Audits, in each among other things we also analyze the functions / hints if the project retains the ability of scamming its investors including
- Infinite minting;
- Anti-rug pool functions;
- Minting Exploits;
- Liquidity pooled;
- Transfer Allowlist;
- Owner tampering;
- Backdoor library.
1 year ago, DeFiYield.App released a 120-page audit on Defrost Finance — click here to see the full pdf file. On page 33rg, we’ve stated the following:
“The Origin EOAs can replace the Oracle address. Collateral asset prices in the vaults of Defrost Finance depend on oracle contracts. In case the new oracle is insecure and can cause a sharp and unpredictable change in the price of an asset, this can lead to liquidation of user collaterals.”
We described the exact smart contract vulnerability that Defrost Finance used to manipulate with fake oracle and rug pull its users. And warned people about it. Accordingly, it was indicated by Coindesk, where the journal has featured our Audit and the warning about the crucial vulnerability that we stated in it:
Apart from this exact vulnerability that was used to rug pull users, we’ve found 151 issues, 13 of which were Critical and High Risk. Those who read our Audit and withdrew funds from Defrost had saved their funds.
We have got in touch with Defrost Finance team 2 times:
- 1 Year ago, after we’ve performed an Audit on them. Back then we texted them to inform them about all the issues that we’ve found, and asked them to improve the correspondent functions of their smart smart contract. They never respond to us.
- Yesterday, after their rug pull. Have they responded? No.
Defrost Finance got caught.
After the PeckShield’s and our investigations that we’ve posted on Twitter, it was clear for the Defrost Finance team that they’ve got caught, and now there is no way for them to simply launder the funds and live in peace in the Bahamas.
That’s how they started to think of ways of returning funds back to the users.
On the next day after the exploit, they proposed a “hacker” a 20% reward for returning the “stolen” funds:
And on the next day, the “hacker” has returned all the stolen $12M:
Following the bounty hacking standard it’s IMPOSSIBLE to get a resolution so fast. The dealing process in the bounty program is much longer.️
However, the Developers Behind the Defrost Finance had a more successful RUG PULL in their Career.
The Developers of Defrost Finance are the same people as the Developers of Phoenix Finance (FinNexus), whose smart contract’s private key has “leaked”, which has resulted in a $7M loss in 2021. Following our research, considering all the inputs, there is a high chance that it was a rug pull, and the private key didn’t just “leak”.
The connection between Phoenix Finance (FinNexus) and Defrost Finance can be found on Defrost’s GitHub:
As pointed by a Twitter User — after the FinNexus got exploited, they forked $FNX to the Phoenix Finance $PHX, and used part of the rugged money to fund the growth of Defrost Finance, to rug pull it again:
UPDATE (28.12.2022)!
In this article we provided all the data needed to prove the rug pull fact behind the Defrost Finance’s $12M scam, showing the connection between Defrost Finance and Phoenix Finance (the project rug pulled in 2021).
Today, our research got featured on CoinTelegraph: https://cointelegraph.com/news/defrost-finance-breaks-silence-on-exit-scam-accusations-denies-rug-pull
After this, we got in touch with Defrost Team asking them to KYC again. Unfortunately, no reply has come from its founders.
What Defrost Finance started doing instead is just banning everyone sending the link to this article in chat. And liying about the “private key getting compromised” — nonsense.
CONCLUSION
We, at DeFiYield.App, have been fighting DeFi Scams for years, as our main goal is for DeFi to become a safer and a more convenient place for a retail investor. We believe that only by being safe and fully trustless, DeFi can be mass adopted and we can finally go Bankless!
That’s why we’ve written the Amazon’s Bestseller: “The Wall Street Era is Over” — the most comprehensive guide on Web3, and how to save your crypto funds.
Have comments or opinions? Let us know!
Check out other articles from the Saga series:
