{"investigation":{"slug":"cover-protocol","entity_name":"Cover Protocol","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Cover Protocol was a decentralized insurance marketplace on Ethereum, launched in November 2020 after a troubled rebrand from the failed SAFE token project. On December 28, 2020, a critical smart contract vulnerability in its Blacksmith farming contract allowed an attacker to mint approximately 40 quintillion COVER tokens and extract over $4 million in assets, crashing the token price by more than 97%. After a failed merger with Yearn Finance and the abrupt departure of core developers, the protocol permanently shut down on September 5, 2021, distributing remaining treasury funds to token holders.","sections":[{"content":"Cover Protocol was founded by an anonymous developer known as 'Alan' (also referred to as 'Insurance Chef') as a peer-to-peer decentralized coverage marketplace on Ethereum. The protocol allowed users to stake collateral to mint CLAIM tokens (redeemable upon an exploit) and NOCLAIM tokens (redeemable if no exploit occurred), functioning as a prediction market for coverage premiums. It was originally launched as 'SAFE' in September 2020 but faced immediate controversy when Alan published a Medium post alleging a user manipulated him into dumping tokens. Critics countered that Alan had failed to properly deploy liquidity before activating mining. The dispute caused SAFE to crash over 90%, falling from approximately $4,000 to under $200. The team subsequently rebuilt from scratch, executing a SAFE-to-SAFE2 migration in September 2020, followed by a SAFE2-to-COVER migration beginning November 20, 2020. Notably, co-founder Azeem Ahmed stepped away from the rebranded project. Early supporters of SAFE experienced an alleged 5.8x dilution of their holdings through this migration process, with SAFE2 holders' ownership of the project allegedly falling from 100% to approximately 17% of total supply. Podcast founder Jason Choi publicly characterized this token restructuring as a 'stealthy rug' in October 2020, citing the reallocation of 70% of new token supply to a new yield farm.","heading":"Background and Origins","sources":[{"url":"https://iq.wiki/wiki/cover-protocol","name":"iq.wiki","type":"other","credibility":3},{"url":"https://www.tronweekly.com/cover-stealthy-rug/","name":"tronweekly.com","type":"other","credibility":3},{"url":"https://bitcoinexchangeguide.com/safe-token-pumping-hard-after-getting-revived-as-cover-protocol/","name":"bitcoinexchangeguide.com","type":"other","credibility":3},{"url":"https://coverprotocol.medium.com/cover-protocol-e202808aa4ef","name":"coverprotocol.medium.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On December 28, 2020, Cover Protocol suffered a critical smart contract exploit that caused the COVER token price to collapse by more than 97% within hours. The vulnerability resided in the Blacksmith.sol farming contract at line 118. The contract cached pool data in memory for gas optimization but failed to update this cached data after modifying storage values. The outdated cache was subsequently used in reward calculations, enabling the attacker to manipulate the accRewardsPerToken value to an arbitrarily inflated figure. The attack proceeded in multiple steps: the attacker exploited a newly approved liquidity mining pool, added LP tokens, removed nearly all tokens to reduce totalTokenBalance, re-deposited tokens causing accRewardsPerToken to spike due to the stale cache, then collected massively inflated rewards. Approximately 40,796,131,214,802,500,000 (40 quintillion) COVER tokens were minted. The primary attacker cashed out approximately $4.4 million, including 1,400 ETH, 1 million DAI, 3,000 LINK, and 90 WBTC, executing the sale primarily via 1inch.exchange. The token price fell from approximately $700–$920 to as low as $5–$24 within hours. Binance halted trading of the COVER token in response. Hours after the exploit, a group identifying as Grap.Finance claimed responsibility as a white hat actor and returned the extracted funds, stating the project should address its vulnerabilities independently. The Cover team subsequently disabled minting access and issued new COVER tokens to affected holders in January 2021. The hack was technically analyzed in detail by blockchain security researcher Mudit Gupta.","heading":"December 2020 Infinite Mint Exploit","sources":[{"url":"https://mudit.blog/cover-protocol-hack-analysis-tokens-minted-exploit/","name":"mudit.blog","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/cover-protocol-suffers-infinite-minting-attack-price-tanks-97","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/markets/2020/12/28/cover-protocol-attack-perpetrated-by-white-hat-funds-returned-hacker-claims","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cryptobriefing.com/defi-developers-claim-cover-protocol-hack-return-funds/","name":"cryptobriefing.com","type":"other","credibility":3},{"url":"https://slowmist.medium.com/a-brief-analysis-of-the-cover-protocol-hacked-event-700d747b309c","name":"slowmist.medium.com","type":"other","credibility":3},{"url":"https://www.financemagnates.com/cryptocurrency/news/binance-halts-trading-of-hacked-defi-project-cover-protocol-token-crashes/","name":"financemagnates.com","type":"other","credibility":3}],"severity":"medium"},{"content":"In November 2020, Cover Protocol announced a merger with Yearn Finance, with Cover intended to serve as the backstop coverage provider for the Yearn product suite. Yearn founder Andre Cronje had previously provided financial support to Alan to enable full-time development of the protocol and served as an advisor. On March 5, 2021, Yearn Finance and Cover Protocol jointly announced the termination of the merger process with no official explanation provided. Community manager DeFi Ted stated publicly he was 'a bit blindsided' by the decision, which he said was communicated with approximately four hours' notice before Yearn's public announcement. Yearn founder Cronje stated on Twitter that he had held 'very high regard, trust, and faith in the Cover team' and called the dissolution 'very sad.' The COVER token dropped approximately 28% in the 30 minutes following this announcement. Some community members attributed the breakup to the launch of Ruler Protocol, a fixed-rate lending product built by Cover's core development team, which some perceived as a conflict of interest or distraction from Cover's core mission.","heading":"Yearn Finance Merger and Dissolution","sources":[{"url":"https://www.coindesk.com/markets/2021/03/05/defi-divorce-yearn-cancels-tie-up-with-cover-protocol","name":"coindesk.com","type":"other","credibility":3},{"url":"https://cointelegraph.com/news/better-as-friends-defi-protocols-yearn-and-cover-announce-cessation-of-merger","name":"cointelegraph.com","type":"other","credibility":3},{"url":"https://ambcrypto.com/yearn-finance-cover-protocol-announce-termination-of-merger-process/","name":"ambcrypto.com","type":"other","credibility":3}],"severity":"medium"},{"content":"On September 5, 2021, Cover Protocol and its affiliated lending product Ruler Protocol simultaneously announced permanent shutdown. Community manager DeFi Ted announced: 'The decision to do this did not come easy and is a final decision the remaining team made after reviewing the path forward, after the core developers suddenly left the projects.' No explanation was provided for the departure of the core development team. Users were advised to withdraw all funds from the protocols immediately. The remaining treasury funds were distributed to COVER and RULER token holders using block 13162680 as a snapshot. DeFi Ted and other remaining team members excluded themselves from this creditor payout. The COVER token fell from approximately $268 to $228 following the announcement, representing a fraction of its all-time high of approximately $1,586 reached in early 2021. The Ruler Protocol, which had been developed by the same core Cover team as a fixed-rate lending product, shut down concurrently. The abrupt and unexplained departure of core developers without transition planning has been described in the community as consistent with a soft exit, though no formal fraud charges have been filed.","heading":"Protocol Shutdown and Developer Abandonment","sources":[{"url":"https://www.coindesk.com/business/2021/09/05/defi-projects-cover-ruler-are-shutting-down-after-development-team-exits","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/80262/defi-insurance-protocol-cover-shuts-down-token-value-plummets","name":"decrypt.co","type":"other","credibility":3},{"url":"https://coinmarketcap.com/academy/article/why-is-binance-delisting-cover-the-end-of-cover-protocol","name":"coinmarketcap.com","type":"other","credibility":3},{"url":"https://cryptodaily.co.uk/2021/09/cover-protocol-delisting-saga","name":"cryptodaily.co.uk","type":"other","credibility":3}],"severity":"medium"},{"content":"No regulatory actions by the SEC, CFTC, or DOJ have been identified against Cover Protocol, its founders, or affiliated team members as of the time of this investigation. No civil lawsuits have been identified in publicly available court records. The anonymous nature of the founding team ('Alan' / 'Insurance Chef') and the pseudonymous operating structure of the project make attribution and potential enforcement difficult. The protocol operated without KYC requirements by design.","heading":"Regulatory and Legal Status","sources":[{"url":"https://iq.wiki/wiki/cover-protocol","name":"iq.wiki","type":"other","credibility":3}],"severity":"medium"},{"content":"Cover Protocol presents multiple compounding risk factors. First, the protocol suffered a critical smart contract vulnerability within approximately five weeks of its official launch, resulting in a near-total token value collapse and the extraction of approximately $4.4 million in assets. While the attacker claiming white hat status returned the funds, the vulnerability itself revealed fundamental smart contract quality issues. Second, the project's predecessor (SAFE) was characterized by at least one credible community figure as a 'stealthy rug' due to extreme token dilution imposed on early supporters through the rebrand migration. Third, the core development team abandoned both Cover and Ruler Protocol without explanation in September 2021, a pattern consistent with exit scams even absent confirmed fraud. Fourth, the project was built around an ironic premise — providing insurance coverage for DeFi exploits — yet left its own users unprotected when exploited. ZachXBT, a credible on-chain investigator, has flagged this entity. The current COVER token has negligible market value (under $1) and no active development.","heading":"Risk Assessment","sources":[{"url":"https://mudit.blog/cover-protocol-hack-analysis-tokens-minted-exploit/","name":"mudit.blog","type":"other","credibility":3},{"url":"https://www.tronweekly.com/cover-stealthy-rug/","name":"tronweekly.com","type":"other","credibility":3},{"url":"https://www.coindesk.com/business/2021/09/05/defi-projects-cover-ruler-are-shutting-down-after-development-team-exits","name":"coindesk.com","type":"other","credibility":3},{"url":"https://decrypt.co/80262/defi-insurance-protocol-cover-shuts-down-token-value-plummets","name":"decrypt.co","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2020-09","event":"SAFE token launches; immediate controversy erupts over founder Alan's handling of liquidity mining deployment, causing SAFE to crash over 90% from ~$4,000 to under $200.","source":"","date_original":"2020-09-01"},{"date":"2020-09-26","event":"SAFE-to-SAFE2 token migration begins (1:1 conversion). Co-founder Azeem Ahmed departs the project.","source":""},{"date":"2020-10-18","event":"Podcast founder Jason Choi publicly labels the SAFE/COVER token structure a 'stealthy rug,' citing 5.8x dilution of early supporters and reallocation of 70% of new supply to a new yield farm.","source":""},{"date":"2020-11-20","event":"SAFE2-to-COVER migration begins. Cover Protocol officially launches on Ethereum mainnet.","source":""},{"date":"2020-11-28","event":"Cover Protocol announces merger with Yearn Finance; Cover to serve as coverage backstop for the Yearn product suite.","source":""},{"date":"2020-12-28","event":"Infinite mint exploit on Blacksmith.sol farming contract. Attacker mints approximately 40 quintillion COVER tokens and extracts ~$4.4 million (1,400 ETH, 1M DAI, 90 WBTC, 3K LINK). COVER token crashes 97%. Binance halts trading. Grap.Finance later claims white hat responsibility and returns extracted funds.","source":""},{"date":"2021","event":"Cover Protocol team distributes new COVER tokens to holders affected by the December 2020 exploit.","source":"","date_original":"2021-01-01"},{"date":"2021-03-05","event":"Yearn Finance and Cover Protocol announce termination of merger. COVER drops ~28% immediately. DeFi Ted states he received approximately four hours' notice before the public announcement.","source":""},{"date":"2021-09-05","event":"Cover Protocol and Ruler Protocol permanently shut down after core development team abruptly abandons both projects without stated reason. DeFi Ted advises users to withdraw all funds immediately. Treasury distributed to token holders at block 13162680 snapshot.","source":""},{"date":"2021-09-05","event":"Binance announces delisting of COVER token following shutdown announcement.","source":""}],"sources_used":[{"url":"https://iq.wiki/wiki/cover-protocol","name":"iq.wiki","type":"other","archive_url":"http://web.archive.org/web/20260420001654/https://iq.wiki/wiki/cover-protocol","credibility":3,"archive_timestamp":"2026-04-20T00:16:54+00:00"},{"url":"https://www.tronweekly.com/cover-stealthy-rug/","name":"tronweekly.com","type":"other","archive_url":"https://web.archive.org/web/20260830133938/https://www.tronweekly.com/cover-stealthy-rug/","credibility":3,"archive_timestamp":"2026-08-30T13:39:38+00:00"},{"url":"https://bitcoinexchangeguide.com/safe-token-pumping-hard-after-getting-revived-as-cover-protocol/","name":"bitcoinexchangeguide.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coverprotocol.medium.com/cover-protocol-e202808aa4ef","name":"coverprotocol.medium.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://mudit.blog/cover-protocol-hack-analysis-tokens-minted-exploit/","name":"mudit.blog","type":"other","archive_url":"https://web.archive.org/web/20260829194743/https://mudit.blog/cover-protocol-hack-analysis-tokens-minted-exploit/","credibility":3,"archive_timestamp":"2026-08-29T19:47:43+00:00"},{"url":"https://cointelegraph.com/news/cover-protocol-suffers-infinite-minting-attack-price-tanks-97","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260101124250/https://cointelegraph.com/news/cover-protocol-suffers-infinite-minting-attack-price-tanks-97","credibility":3,"archive_timestamp":"2026-01-01T12:42:50+00:00"},{"url":"https://www.coindesk.com/markets/2020/12/28/cover-protocol-attack-perpetrated-by-white-hat-funds-returned-hacker-claims","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251026132254/https://www.coindesk.com/markets/2020/12/28/cover-protocol-attack-perpetrated-by-white-hat-funds-returned-hacker-claims","credibility":3,"archive_timestamp":"2025-10-26T13:22:54+00:00"},{"url":"https://cryptobriefing.com/defi-developers-claim-cover-protocol-hack-return-funds/","name":"cryptobriefing.com","type":"other","archive_url":"http://web.archive.org/web/20260307211417/https://cryptobriefing.com/defi-developers-claim-cover-protocol-hack-return-funds/","credibility":3,"archive_timestamp":"2026-03-07T21:14:17+00:00"},{"url":"https://slowmist.medium.com/a-brief-analysis-of-the-cover-protocol-hacked-event-700d747b309c","name":"slowmist.medium.com","type":"other","archive_url":"http://web.archive.org/web/20250909125049/https://slowmist.medium.com/a-brief-analysis-of-the-cover-protocol-hacked-event-700d747b309c","credibility":3,"archive_timestamp":"2025-09-09T12:50:49+00:00"},{"url":"https://www.financemagnates.com/cryptocurrency/news/binance-halts-trading-of-hacked-defi-project-cover-protocol-token-crashes/","name":"financemagnates.com","type":"other","archive_url":"https://web.archive.org/web/20260829202415/https://www.financemagnates.com/cryptocurrency/news/binance-halts-trading-of-hacked-defi-project-cover-protocol-token-crashes/","credibility":3,"archive_timestamp":"2026-08-29T20:24:15+00:00"},{"url":"https://www.coindesk.com/markets/2021/03/05/defi-divorce-yearn-cancels-tie-up-with-cover-protocol","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20251122201532/https://www.coindesk.com/markets/2021/03/05/defi-divorce-yearn-cancels-tie-up-with-cover-protocol","credibility":3,"archive_timestamp":"2025-11-22T20:15:32+00:00"},{"url":"https://cointelegraph.com/news/better-as-friends-defi-protocols-yearn-and-cover-announce-cessation-of-merger","name":"cointelegraph.com","type":"other","archive_url":"http://web.archive.org/web/20260314082342/https://cointelegraph.com/news/better-as-friends-defi-protocols-yearn-and-cover-announce-cessation-of-merger","credibility":3,"archive_timestamp":"2026-03-14T08:23:42+00:00"},{"url":"https://ambcrypto.com/yearn-finance-cover-protocol-announce-termination-of-merger-process/","name":"ambcrypto.com","type":"other","archive_url":"https://web.archive.org/web/20260829190711/https://ambcrypto.com/yearn-finance-cover-protocol-announce-termination-of-merger-process/","credibility":3,"archive_timestamp":"2026-08-29T19:07:11+00:00"},{"url":"https://www.coindesk.com/business/2021/09/05/defi-projects-cover-ruler-are-shutting-down-after-development-team-exits","name":"coindesk.com","type":"other","archive_url":"https://web.archive.org/web/20260915234915/https://www.coindesk.com/business/2021/09/05/defi-projects-cover-ruler-are-shutting-down-after-development-team-exits","credibility":3,"archive_timestamp":"2026-09-15T23:49:15+00:00"},{"url":"https://decrypt.co/80262/defi-insurance-protocol-cover-shuts-down-token-value-plummets","name":"decrypt.co","type":"other","archive_url":"http://web.archive.org/web/20260514192140/https://decrypt.co/80262/defi-insurance-protocol-cover-shuts-down-token-value-plummets","credibility":3,"archive_timestamp":"2026-05-14T19:21:40+00:00"},{"url":"https://coinmarketcap.com/academy/article/why-is-binance-delisting-cover-the-end-of-cover-protocol","name":"coinmarketcap.com","type":"other","archive_url":"http://web.archive.org/web/20251223124944/https://coinmarketcap.com/academy/article/why-is-binance-delisting-cover-the-end-of-cover-protocol","credibility":3,"archive_timestamp":"2025-12-23T12:49:44+00:00"},{"url":"https://cryptodaily.co.uk/2021/09/cover-protocol-delisting-saga","name":"cryptodaily.co.uk","type":"other","archive_url":"http://web.archive.org/web/20251014035244/https://cryptodaily.co.uk/2021/09/cover-protocol-delisting-saga","credibility":3,"archive_timestamp":"2025-10-14T03:52:44+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:59.413099+00:00","updated_at":"2026-09-15T23:55:19.129821+00:00"}}