BaseBros Fi Developers Execute Rug Pull, Stealing $130,000

The developers of the DeFi project BaseBros Fi have executed a rug pull, withdrawing approximately $130,000 from investors. This was achieved through an unaudited, unverified Vault contract, which allowed the team to override core functions and drain the funds.

Chain Audits Report

Chain Audits, a blockchain security firm, disclosed that the BaseBros Fi developers exploited a loophole in the Vault contract. Despite auditing four out of five algorithms used by BaseBros Fi, the unverified contract contained a backdoor that facilitated the theft.

Details of the Exploit

The exploit involved redefining key functions in the Strategy contract, enabling the unauthorized withdrawal of assets from multiple pools. Chain Audits clarified that they did not audit the specific contract used in the exploit, as it was deployed after their review.

Seamless Project Cleared

Amid concerns, the Seamless project, also based on the Base blockchain, was suspected of being affected due to similar contract markings. However, a thorough internal investigation by the Seamless team confirmed no signs of exploitation, assuring investors that their funds were secure.

Aftermath and Ongoing Investigation

Following the incident, stolen funds were traced to the crypto mixer Tornado Cash. All social media accounts associated with BaseBros Fi have been deleted, and the team remains uncontactable. This incident underscores the importance of comprehensive contract audits and vigilance in the DeFi space.
In light of this event, it is crucial for investors and developers alike to prioritize security audits and remain cautious of unaudited contracts. The broader impact on the crypto market highlights the need for enhanced security measures to protect investor funds and maintain trust in decentralized finance projects.