cryptoglobe.com
An ethereum user was scammed out of $140,000 in Uniswap (UNI) tokens after attempting to yield farm a fake DeFi project.
According to a series of tweets by ZenGo researcher Alex Manuskin, an anonymous user dubbed “Jhon Doe” was scammed out of $140,000 worth of UNI governance tokens after attempting to yield farm the protocol UniCats.
If you are not yet convinced that you should NOT be approving infinite tokens to some random smart contract/Dapp, here’s a story of how Jhon Doe lost $140K worth of UNI in their sleep.
— Alex Manuskin (@amanusk_) October 5, 2020
1/
👇 pic.twitter.com/QltkevnzDY
Manuskin speculated Jhon Doe thought they had hit on the next big thing in DeFi with UniCats, rather than stumbling across a scam. The anonymous user transferred UNI to the unknown protocol and began farming “$MEOW” with the intention of turning a profit.
However, when Jhon attempted to withdraw their deposited tokens they encountered the scam setup created through the protocol’s smart contract. According to Manuskin, the UniCat contract allows the platform to withdrawn tokens at any time, resulting in a “rug pull” scam.
UniCat adds a backdoor to the farming contract. Anyone who is the owner can call the "setGovernance" method, with the privilege to call any passed data, to any address. pic.twitter.com/rOvmtZ82xP
— Alex Manuskin (@amanusk_) October 5, 2020
Manuskin explained how the contract was able to transfer Jhon’s deposited Uniswap tokens, resulting in the loss of more than 36K UNI ($140K).
The ZenGo researcher also explained that UniCat generates a new contract for each victim allowing the platform to continue scamming users out of their deposited funds.
Each new contract fishes out some funds, swaps them on Uniswap, and passes them to and address owned by UniCat. Stolen ETH are then moved into @TornadoCash , in bulks of 100ETH before moving on to the next victimhttps://t.co/N8A4ULC2tp
— Alex Manuskin (@amanusk_) October 5, 2020
Featured Image Credit: Photo via Unplash.