BaseBros Fi was a decentralized finance (DeFi) tool on the Base blockchain. It suddenly went away after pulling the rug out from under users, leaving them without their money. On September 13, the project removed its website and social media accounts, which meant that it could no longer talk to its users.
The rug pull was made possible by a smart contract called the “Vault Contract” that had not been checked. A blockchain security company called Chain Audits had already looked over most of BaseBros’ contracts, but they had forgotten to look over this one. The contract that hadn’t been reviewed had a secret flaw that let the project’s owners take back user deposits into a “Strategy” contract.
By the time it went away, BaseBros had over 3,300 users in its Telegram group and about 2,000 fans on X (formerly Twitter). Users were confused when the project’s website disappeared all of a sudden, and they later found that the owners had taken about $130,000 worth of cryptocurrency. Blockchain security experts at Cyvers say that the stolen money was moved through Tornado Cash, a service that is known for being hard to track down.
At first, people were worried that the attack might have spread to the Seamless system, which used the same contract marks. Later, though, both Seamless and Chain Audits proved that the rug had been pulled out from under only BaseBros. Seamless looked into the matter internally and told its customers that their money was safe.
This shows the dangers of DeFi contracts that haven’t been checked by a third party; flaws can be used to steal money without anyone knowing. The BaseBros rug pull is a stark warning of how important it is to carefully check contracts to protect owners.
There have been a lot of hacks and scams in the DeFi world in the last few months. For instance, Penpie just lost $27 million in a similar attack, and Euler Finance lost $195 million earlier this year.
