Swaprum A Dex on Arbitrum Blockchain Rug Pull

Image source: by @Lucas75831804

 Swaprum Decentralized Exchange on Arbitrum Chain rug pulled, developer escaped with 1,628 ETH worth $3m from the protocol's liquidity pool.

Swaprum's website shows that the blockchain security firm Certik audits the protocol.  Derrick last audited the exchange on 5 May,  which raises the question of how the rug pull came to be.

Beosin another security firm analysis showed that Swaprum had a backdoor that allowed the deployed to remove liquidity from the protocol. "Add() backdoor function was used by Swaprum deployed to steal the LP tokens staked by users,  then removed liquidity from the pool for a profit," Beosin tweeted. It explains that the backdoor has not always been there when it was audited but the deployers recently upgraded the DEX's "normal liquidity collateral reward contracts to a contract containing backdoor. 

Swaprum on Arbitrum rugged for ~$3M.

The deployer of Swaprum used the add() backdoor function to steal LP tokens staked by users, then removed liquidity from the pool for profit.

One tx:https://t.co/qRXLhrAIqp pic.twitter.com/xf7vrciajN

— Beosin Alert (@BeosinAlert) May 19, 2023

 After the rug pull, Swaprum deleted all its social media accounts and groups. The native token SAPR has plummeted by 100% leaving the investor at a total loss.

If you have interacted with Swaprum,  it is advisable to disconnect/revoke its permission from your wallet. Below are the ways to disconnect your wallet from any site.

Note: Disconnecting and Revoking approvals are not the same thing. Following the steps below will only disconnect your wallet from the app.  Depending on what it originally requested,  this will prevent it from viewing your public address,  wallet contents,  transaction history,  and even the ability to initiate transactions.

It will not revoke any token approvals that you have in place with that dapp,  meaning that even if you disconnect the dapp,  it may still be able to access and move your tokens.  For more information on how to revoke approvals,  see this blog post on how to remove unauthorized spenders from your wallet. 

Step 1: Within the account view,  click on the 3 dots button in the top right corner. 

Step 2: in the expanded menu,  click on "Connected Sites".

Step 3: Click on the "Disconnect" next to any sites you wish to disconnect from.

Remember after you disconnected from the site make sure you revive the approval mentioned above earlier too to be safe. 

Spread the news