BaseBros Fi, a decentralized finance (DeFi) protocol on the Base blockchain, vanished after stealing user funds. The project used an unaudited smart contract to siphon off investments. This rug pull shocked the community, especially since BaseBros Fi had a presence on social media and a seemingly active user base. Here’s what happened:Â
Timeline of Events:Â
- September 13: BaseBros Fi deleted its website and social media accounts, including X and Telegram.Â
- Security Breach: Blockchain security firm Chain Audits discovered that BaseBros used an unaudited “Vault” smart contract. This contract contained a backdoor vulnerability, allowing the owners to withdraw funds without users’ consent.Â
- User Base: At the time of its disappearance, BaseBros Fi had around 2,000 followers on X and over 3,300 members on Telegram.Â
What Went Wrong?Â
- Auditing Issues: Chain Audits had reviewed four out of five smart contracts used by BaseBros. However, the critical “Vault” contract was left unaudited and unverified. This was the entry point for the rug pull.Â
- Backdoor Access: The unaudited contract allowed the project owners to withdraw funds deposited into the “Strategy” contract without user permission.Â
- Fund Siphoning: Blockchain investigator Cyvers reported that the attackers managed to siphon $130,000 using a crypto mixing service called Tornado Cash. This made it harder to trace the stolen funds.Â
Impact on Other Protocols
Initially, some confusion arose about whether the rug pull affected other protocols on the Base blockchain. The seamless protocol was wrongly assumed to be impacted due to similar contract labeling. However, after an internal investigation, Seamless confirmed that both the protocol and investors’ funds were safe.Â
Summary Table:Â
Aspect | Details |
Platform | Base blockchain |
Project | BaseBros Fi |
Audited Contracts | 4 out of 5 by Chain Audits |
Unaudited Contract | “Vault” contract with backdoor vulnerability |
Disappearance Date | September 13 |
Amount Stolen | $130,000 (approx.) |
Method Used | Tornado Cash (crypto mixing service) |
Number of Followers | 2,000 on X, 3,300 on Telegram |
Impact on Other Protocols | None (Seamless protocol confirmed safe) |
 Noteworthy Incidents in DeFi
This incident follows other high-profile DeFi hacks and rug pulls. Recently, a hacker behind the $27 million Penpie hack received praise from the Euler Finance hacker. The latter had returned 90% of the stolen $195 million in exchange for legal immunity and a 10% reward.Â
Key Takeaways:Â
- Importance of Audits: Unverified smart contracts are a significant risk in DeFi. Always ensure that all contracts, especially those involving user funds, are thoroughly audited.Â
- User Vigilance: Users should be cautious and conduct their own research before investing in DeFi projects. A project’s social media presence does not guarantee its legitimacy.Â
- Security Firms’ Role: Security firms play a crucial role in identifying vulnerabilities. However, even an audit is not a foolproof guarantee against fraud.Â
- Recovery Challenges: Once funds are stolen through a crypto mixer, recovering them becomes incredibly difficult. The decentralized nature of blockchain makes tracking and recovering assets a challenge.Â
This incident serves as a reminder of the inherent risks in DeFi. While these platforms offer innovative financial services, they are still susceptible to scams and hacks. Investors must remain vigilant and prioritize security when engaging with DeFi protocols.Â
Disclaimer
FAQ
DeFI stands for decentralized finance, offering open and accessible financial systems built on blockchain technology.
Yield farming involves earning interest by lending or staking cryptocurrencies.
Layer 1 blockchains are the primary networks (e.g., Ethereum), while layer 2 blockchains scale and improve performance on top of them.
