Mars Robertson marsrobertson

A 10M USD RUG on Moonriver

Warning: The following analysis may contain incorrect information, please verify everything yourself before believing in these info.

Would be nice to have someone better in on-chain analysis to double check these.

Background

SatrunBeam Finance was a yield aggregator on Moonriver, a EVM-Compatible parachain on Kusama in the Polkadot ecosystem.

It attracted several millions of liquidity within a month. The team is anon and they claimed that the contracts are audited by BitRise whose domain name was only registered on 2022-08-22 (https://who.is/whois/bitriseaudits.com). And the contracts were never actually verified on the block explorer.

	// SPDX-License-Identifier: GPL-3.0

	pragma solidity >=0.7.0 <0.9.0;


	contract Base {
	uint256 number = 69420;
	function operation(uint256 addme) public view returns (uint256) {
	return number + addme;
	}

	pragma solidity 0.5.14;

	contract Factory {
	Contract[] newContracts;

	constructor(bytes32 name) public {
	createContract(name);
	}

	function createContract (bytes32 name) public {

	/**
	* @title Arbitrable
	* @author Clément Lesaege - <[email protected]>
	* Bug Bounties: This code hasn't undertaken a bug bounty program yet.
	*/

	pragma solidity ^0.4.15;

	import "./IArbitrable.sol";

	<!--
	REMEMBER TO UPDATE CORS USING "normal quotes"

	ipfs config --json API.HTTPHeaders.Access-Control-Allow-Methods '["PUT", "GET", "POST", "OPTIONS"]'

	ipfs config --json API.HTTPHeaders.Access-Control-Allow-Origin '["*"]'
	-->

	<!DOCTYPE html>
	<html>

	/**
	* @title Arbitrable
	* @author Clément Lesaege - <[email protected]>
	* Bug Bounties: This code hasn't undertaken a bug bounty program yet.
	*/

	pragma solidity ^0.4.15;

	import "./IArbitrable.sol";