Ordinals Finance, a DeFi protocol on Ethereum that enables lending and borrowing of inscriptions, stands accused of carrying out an exit scam, also referred to as a “rug pull.”
In a press release dated April 24th and seen by Cointelegraph, blockchain security company CertiK stated that the developer of the protocol executed a “safuToken” function to withdraw 256 million OFI tokens from its smart contracts. CertiK further mentioned that an additional 13 million OFI tokens were removed through an “ownerRewithdraw” function, resulting in a total of 269 million tokens withdrawn.
We can confirm that the @ordinalsfinance exit scam has resulted in a loss of $1 million.
All social media accounts have been deleted as well as the project’s website.
Funds have been consolidated into EOA 0x34e…25cCF https://t.co/RA7vSjNajI
— CertiK Alert (@CertiKAlert) April 24, 2023
CertiK reports that investors have incurred a total loss of $1 million. Before the alleged exit, CoinGecko data indicates OFI’s market capitalization stood at $2.3 million but it plummeted to slightly over $143,000 afterward, implying that investors lost over $2 million. Nevertheless, some OFI token holders may have sold their tokens when the news broke, resulting in CertiK reporting a lower amount.
Blockchain data demonstrates that the Ordinals deployer account employed the safuToken function to withdraw over 256 million OFI tokens, which were subsequently transmitted to a separate Ethereum account via multiple transactions. Before depositing the tokens into Tornado Cash, this address received OFI tokens from multiple accounts.
The project’s Twitter account is believed to have been removed.
Additional analysis shows that after receiving 256 million OFI tokens, the deployer account conducted 12 separate transactions swapping OFI for Ether (ETH).
The deployer subsequently transferred over 85.5 ETH to the account ending in “cCF,” following which it was deposited into Tornado Cash.
The safuToken transfer was executed via a contract labeled “OEB Staking.” This function, listed at lines 1445-1450 on the bottom of the file, appears to enable the “owner” of the contract to transfer all staked tokens to itself.
The Ordinals deployer account also made multiple requests to the OFI Staking contract to transfer tokens to itself, using a function called “ownerRewithdraw” on lines 305-308. This function seems to allow the owner to withdraw any amount of tokens from the staking contract as long as the balance in the contract is higher than a variable named “totalOwedValue.”
