Kannagi Finance was a decentralized yield aggregation protocol hosted on zkSync Era. In July 2023, the team behind the project performed a rug pull, stealing an estimated $2.13M from the project.
Inside the Rug Pull
The Kannagi Finance rug pull occurred less than two months after the project had launched on the Ethereum Layer 2, zkSync. In that time, the project had accumulated approximately $2.13 million in total value locked.
The July 2023 rug pull stole almost every bit of value from the contract, leaving only $0.17 in TVL. The project team also deleted its website, Twitter, and GitHub code repositories.
The code of the rugged vault contracts had undergone a security audit. However, the deletion of the contracts on GitHub makes it difficult to determine how the exploit was carried out. Additionally, the launched contract code was unverified, which may point to the inclusion of additional, malicious functionality after the audit was completed.
Lessons Learned from the Attack
Rug pulls have become common in recent months; however, this was the first major one to occur on the zkSync L2. The rug pull also came shortly after the hack of EraLend, another project hosted on zkSync.
Often, rug pulls have warning signs, such as the unverified contract for Kannagi Finance. To learn more about how to spot a potential rug pull before investing, check out our blog on the Warning Signs of an Exit Scam.