DeFi Project Layer.Farm Steals $700k – Here’s What Happened is the latest Polygon Network-based DeFi project to rug users of their funds, with more than $700k stolen in this novel exploit. Found out how they did it in this blog post.

LayerFarm was a new DeFi yield farm launching on the Polygon and Binance Smart Chain networks. The project differentiated itself by having “multilevel farming worlds” and was able to attract over $450k in total value locked (TVL) just 5 hours after launching.

The Layer multilevel farming worlds interface

With zero deposit fees for many pools, users were attracted to this farm for high yields on their staked funds without the risk of losing money to deposit fees or having to wait several hours with harvest lockups.

However, there were some red flags:

  • The project was rushed, announced, and began in all in the span of less than a dozen hours
  • There was no time lock on the MasterChef contract
  • There was novel new code involving NFTs (we’ll explain this part later)

So all-in-all, raised some eyebrows as they began their launch.

It wasn’t until hours after launch did they decide to pull off this clever rug…

So, How Did it Happen?

To better understand how this malicious code worked, it might be helpful to understand exactly what happens when you deposit your funds in a farm.

For example, let’s say you head on over to and deposit 100 BIFI tokens into their vault. In return, you’d receive a certain amount of mooTokens (let’s say, 100) that represent your share of the vault.

Think of the mooTokens as a receipt you’d receive to prove you own your staked funds. And if Beefy wanted to take a small deposit fee, they could simply give you 4% less mooTokens (in this case, 96 total) and send the other 4 to a different address that collects the fees.

Once you’re ready to get your staked funds back, you’d simply hand over your mooTokens in exchange for your deposited funds (plus any yield the vault generated).

Sounds simple, right?

This is where differed.

Instead of giving mooTokens in exchange for funds, had a novel method of giving away an nftToken to users who staked their funds.

And whenever you’d want to take your funds back, you’d give back this nftToken… Or, that was how it was supposed to work.  

You see, while’s smart contracts might have looked normal for the most part, there was one piece of code that was responsible for this attack:

The malicious NFT minting code used to steal the funds

And here are other links you might find useful before we dive in.

Now since the MasterChef contract was drained of different tokens in various liquidity pools, let’s focus on the MATIC token for an explanation by inspecting the attacker’s transactions.

Here’s the tl;dr version in 5 steps:

  1. The attacker called the contract’s wrap function and transferred 11,500 MATIC to the MasterChef contract.
  2. The NFT contract then gave 11,500 nftToken (the receipt) to the attacker in return. 4% (or, in this case, 460 nftToken) were minted in thin air and sent to the fee address.
  3. The attacker called the unwrap() function, which gave back the 11,500 MATIC.
  4. Now, this is where the extra money comes in. Since the fee address has an extra 460 nftTokens generated as a fee, the attacker simply calls the unwrap() function again to drain the 460 MATIC from the MasterChef contract.
  5. Rinse and repeat steps 1-4 until all the MATIC is drained from the MasterChef.

The attacker simply had to redo this process for each of the pools to steal all users’ funds. Since this is a rather novel code and might take a bit more explaining to fully understand…

Here’s the more detailed version, explained with USDT:

  1. First, the Attacker Contract’s Owner (ACO) sends in 10,400 USDT to the attacker contract.
  2. Next, the Attacker Contract (AC) calls the function setApprovalForAll on the NFT contract. This gives MasterChef approval to transfer tokens to and from the AC and AO.
  3. The AC calls the nftTokens are then minted to the AC.
  4. 4% deposit fees are given to the Fee address via minting nftTokens directly. However, no deposit fees were taken out from the AC’s original deposit.
  5. AC calls the “unwrap” function. The MasterChef contract, by design, checks the NFT balance of the AC and sees 10,400 nftTokens in pid 10. It then burns the nftTokens.
  6. In exchange, 10,400 USDT is sent back to the AC.
  7. The attacker repeats this process 21 times before swapping his USDT stack to PolyDoge. They then repeat the above steps again many more times, gaining more USDT and PolyDoge in the process.
  8. The attacker swaps PolyDoge to other tokens.
  9. The attacker finally unwraps his minted NFTs into the corresponding tokens and essentially drains the MasterChef contract of all users’ funds.

The Aftermath of’s Exploit

The attacker managed to steal a total of $717,421 in various crypto assets, not including their native token LAYER’s liquidity pool assets. Take a look at the chart below for a summary of what was stolen:

This chart shows the funds stolen as well as the total USD value.

Do Your Own Research (DYOR)

Before aping into any yield farm, we ALWAYS advise you to do your own research and come up with a risk mitigation strategy beforehand. Never invest more than you can afford to lose, especially in newer, unestablished yield farms.

DeFi is inherently risky, risk management is key. had a novel exploit never before seen in the yield farming space. Novel rugs like this are the exact reason we updated our yield farm risk ratings system so that all new farms can only receive a “some risk” rating at best.

For an overview on how we rank our risk ratings, check out the video below:

Have a burning question you want answered about DeFi or yield farms? Head on over to our Telegram channel and join our amazing community!

And as always, stay safe in the DeFi world.

Signing off,

The RugDoc Team


🟢 For owners who have made impactful changes and would like an update to their farm review:

1️⃣ Use #update at @RugDocChat with your description and proof of changes and it will be forwarded to our scanners.

2️⃣ This does not guarantee a change in your review.

3️⃣ Owners who have difficulty solving the issues can consider our Consultation Package – please contact @BaymaxCrypto on Telegram to discuss.

Our mission here at RugDoc is to screen for hard rug code that results in 100% theft of ALL underlying funds for ALL participants.

This is the ONE part of the due diligence process that most people cannot simply do on their own as it costs thousands of dollars to hire a senior solidity developer to look over a farm for safety.

A project coin with terrible code can go up in price, and a project with good code and a good team can also go down in price.

Do NOT use our ratings to refer to your likelihood in making money if you invest in the project. They are ONLY in reference to code safety.

Everything else beyond code safety is YOUR responsibility to go do research on. We just make sure the casino you’re betting in won’t rob you before you even get to place a bet.

Our reviews for projects are organized into a few colors.

🟢 Least Risk
These projects are the least likely to hard or soft rug. Usually reserved for cornerstone projects of an ecosystem where it makes no financial sense for them to rug in any manner as they make more money just being legit.

🔵 Low Risk
These projects are usually established projects in an ecosystem that have a track record of success or have KYC’d to us or other authoritative sources in the real world. As a result, it is extremely unlikely for them to soft rug or hard rug their projects. The projects can still fail and the token price can go down, but usually more as a result of natural market forces.

⚪️ Some Risk
This is the default rating for projects with unknown teams but have code that is unlikely to have hard rug risk. Since the team is unknown and doesn’t have a track record of success, it’s entirely possible that they may try to soft rug by dumping tokens, abandoning the project, etc. Even a last minute contract swap to a malicious contract is possible. The only thing that is unlikely is a complete hard rug as long as you are 100% sure you deposit into the contract we review.

🟠 Medium Risk
Similar to Some Risk, but the underlying code itself is custom enough or complex enough that it warrants an elevated risk rating that needs deeper research. Make sure you read every point presented to make sure you’re comfortable with that before entering. Still unlikely to hard rug, but more chances of custom code behaving incorrectly and causing other issues.

🔴 High Risk
Project contains code or practices that are HIGHLY LIKELY to lead to catastrophic losses as they are right now. Make sure you read the description carefully as we will always warn what these issues are. If you see the words Hard Rug anywhere in the review, STAY FAR AWAY!

⚫️ Not Eligible
We reserve the right to not review exceedingly complex projects that would require tens of thousands of dollars of senior security analyst man hours. Typically these are projects that deal with leverage, lending, options, derivatives, and anything that is overly complex and which requires tons of peer reviews and audits from top audit companies.