The team behind DeFi protocol BaseBrosFi executed a rug pull and funneled $130,000 through TornadoCash.
A DeFi protocol called BaseBrosFi, which operated on the Ethereum layer-2 Base, rug pulled its users on September 13. BaseBrosFi provided yield optimization use cases to users. The protocol’s team had multiple contracts audited but one and used the unaudited contract to pull one over BaseBrosFi users.
ChainAudits, a blockchain cybersecurity firm, had audited four out of five BaseBrosFi contracts and confirmed that the rug pull occurred due to the unaudited contract. That contract was never verified on-chain, either. In an X post, Chain Audits reported the scam, “@BaseBrosFi, a DeFi project on @base, executed a rug pull by gaining control of and draining ecosystem funds via an unaudited and unverified Vault contract.”
The now non-existent protocol took down its social accounts as well, leaving its 2,000 X followers and 3,300 Telegram members behind. Before doing so, it gained control over the ‘Vault Contract’ and drained all the funds associated with BaseBrosFi pools. This Vault Contract let the protocol’s team override the controls present in its ‘Strategy Contracts’ to retire them.
ChainAudits defended itself, saying it “had no involvement with the unverified contracts used in the exploit, and the contracts deployed after the audit were not provided to ChainAudits.” So, there was no way for the security company to audit the malicious contract or flag it.
The Incident Aroused Worries for Another Protocol Due to Similarly Named Contracts
The names of BaseBroFi’s contracts were the reason for confusion among blockchain security firms. Cyvers reported that Seamless, another DeFi protocol on Base with similarly named contracts, was hit with the rug pull instead. However, Seamless’s team confirmed that was not the case. ChainAudits rectified the situation, confirming that the executed rug pull affected BaseBrosFi and not Seamless. Nevertheless, the Cyvers followed the funds rug pulled from the BaseBrosFi contract and found that the team siphoned $130,000 through crypto mixer TornadoCash.
