BaseBros Fi, a decentralized finance (DeFi) yield optimization protocol built on the Base blockchain, has abruptly disappeared, taking with it users’ investments. On September 13, BaseBros wiped its website and deleted its social media accounts on X and Telegram, leaving users with losses and no explanation.
Blockchain security firm Chain Audits revealed that the rug pull was executed via an unaudited and unverified Vault contract, which was not part of their original security assessment. Chain Audits had previously audited four of the five BaseBros smart contracts, but the critical contract responsible for the theft was excluded from the audit. This contract had a hidden backdoor that allowed the project’s owners to siphon funds deposited by users into a 'Strategy' contract, leading to significant financial losses.
Before its disappearance, BaseBros had built a modest community, boasting approximately 2,000 followers on X and over 3,300 members on its Telegram channel. The sudden rug pull scam left users in shock, as many were unaware of the vulnerability in the smart contract they were interacting with.
Initially, some reports mistakenly linked the BaseBros rug pull with the Seamless protocol due to similar contract names. However, blockchain investigator Cyvers quickly clarified the confusion, confirming that the attack was isolated to BaseBros. The attacker behind the rug pull laundered $130,000 through the crypto mixing service Tornado Cash.
Seamless conducted its own internal investigation to ensure the safety of its platform and users. After thorough checks, the Seamless team confirmed that their protocol and user funds were unaffected by the BaseBros rug pull. Chain Audits also reiterated that BaseBros was the only protocol compromised in the incident.
Also Read: Crypto ATM Frauds Targeting Elderly, Senate Demands Action