{"investigation":{"slug":"paraluni-masterchef","entity_name":"Paraluni Masterchef","trust_score":18,"severity_base":null,"score_modifier":0,"confidence":0.82,"status":"published","content_type":"investigation","summary":"Paraluni is a metaverse DeFi yield-farming protocol deployed on Binance Smart Chain (BSC). On March 13, 2022, its MasterChef smart contract was exploited via a reentrancy vulnerability in the depositByAddLiquidity function, resulting in approximately $1.7 million in losses. The attacker laundered the proceeds through Tornado Cash and never returned funds despite a public appeal from the Paraluni team.","sections":[{"content":"Paraluni is a metaverse-oriented decentralized finance project operating on Binance Smart Chain (BSC). The protocol offered liquidity provision and yield-farming through a MasterChef contract, a common DeFi pattern in which users deposit LP tokens to earn protocol rewards. The project positioned itself as a BSC metaverse ecosystem. No independently verified information is available regarding the project's founding team or corporate structure.","heading":"Background","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-paraluni-hack-march-2022","name":"Explained: The Paraluni Hack (March 2022) — Halborn","type":"research","credibility":2},{"url":"https://slowmist.medium.com/paraluni-incident-analysis-58be442a4f99","name":"Paraluni Incident Analysis — SlowMist / Medium","type":"research","credibility":2}],"severity":"low"},{"content":"On March 13, 2022 at approximately 00:04:30 UTC, an unknown attacker exploited a critical reentrancy vulnerability in Paraluni's MasterChef contract, stealing approximately $1.7 million. The exploit targeted the depositByAddLiquidity function, which contained two compounding flaws: it did not validate that the LP token constructed from the caller-supplied _tokens array matched the LP token in the pool identified by the _pid parameter, and it lacked a reentrancy guard during liquidity calculations. The attacker deployed two malicious ERC-20 tokens — UBT and UGT — with custom transferFrom functions. Using PancakeSwap flash loans totaling roughly 157,000 USDT and 157,000 BUSD, the attacker minted approximately 155,935 Paraluni LP tokens, then called depositByAddLiquidity with pool ID 18, supplying only 1 UBT and 1 UGT. During the transfer call, the malicious transferFrom function re-entered MasterChef.deposit(), crediting the attacker with LP tokens twice before state variables were updated. The attacker then withdrew liquidity through both the malicious contract and directly, netting roughly 310,000 USDT and 310,000 BUSD after repaying the flash loan. The primary attack transaction is documented on BscScan (0x70f367b9420ac2654a5223cc311c7f9c361736a39fd4e7dff9ed1b85bab7ad54) and the attacker's address is 0x94bc1d555e63eea23fe7fdbf937ef3f9ac5fcf8f. Security firms CertiK, SlowMist, Halborn, and Lunaray all independently confirmed this attack vector.","heading":"Exploit: Reentrancy Attack on MasterChef Contract (March 2022)","sources":[{"url":"https://www.certik.com/resources/blog/4mPLWLwyKG4xy30x65uLgw-paraluni-exploit","name":"Paraluni Exploit — CertiK Blog","type":"research","credibility":2},{"url":"https://slowmist.medium.com/paraluni-incident-analysis-58be442a4f99","name":"Paraluni Incident Analysis — SlowMist / Medium","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-paraluni-hack-march-2022","name":"Explained: The Paraluni Hack (March 2022) — Halborn","type":"research","credibility":2},{"url":"https://medium.com/coinmonks/hackers-exploited-reentrancy-vulnerability-to-attack-paraluni-and-made-more-than-1-7-b748843c6487","name":"Hackers exploited reentrancy vulnerability to attack Paraluni — Lunaray / Coinmonks / Medium","type":"research","credibility":2},{"url":"https://bscscan.com/tx/0x70f367b9420ac2654a5223cc311c7f9c361736a39fd4e7dff9ed1b85bab7ad54","name":"Attack transaction — BscScan","type":"on_chain","credibility":1},{"url":"https://bscscan.com/address/0x94bc1d555e63eea23fe7fdbf937ef3f9ac5fcf8f","name":"Attacker address — BscScan","type":"on_chain","credibility":1}],"severity":"critical"},{"content":"Following the exploit, the attacker converted the stolen USDT and BUSD to BNB on BSC. The BNB was then swapped for ETH and cross-chained from BSC to Ethereum via cBridge. On-chain tracking by SlowMist and CertiK confirmed the attacker's BSC wallet held approximately 3,000 BNB (roughly $1.125 million at time of theft) and cross-chained approximately 235 ETH (roughly $608,600) to Ethereum. The attacker subsequently deposited 660 ETH into Tornado Cash across 12 separate transactions, a standard obfuscation technique. Funds were not recovered. PeckShield first publicly identified the exploit and attacker activity via its alert account.","heading":"Fund Flow and Laundering","sources":[{"url":"https://slowmist.medium.com/paraluni-incident-analysis-58be442a4f99","name":"Paraluni Incident Analysis — SlowMist / Medium","type":"research","credibility":2},{"url":"https://www.certik.com/resources/blog/4mPLWLwyKG4xy30x65uLgw-paraluni-exploit","name":"Paraluni Exploit — CertiK Blog","type":"research","credibility":2},{"url":"https://twitter.com/peckshield/status/1502817503877074947","name":"PeckShield alert tweet — March 13, 2022","type":"social_media","credibility":2}],"severity":"critical"},{"content":"After the exploit, the Paraluni team issued a public statement offering to classify the incident as a white-hat disclosure and offering a financial reward if the attacker agreed to return the stolen funds. The attacker did not respond to this offer. No funds were restituted to affected users. Multiple security researchers noted that the two vulnerabilities — missing input validation on _pid and absence of a reentrancy guard — are well-known vulnerability classes that would have been detected by a standard smart contract audit, raising questions about the project's pre-deployment security practices.","heading":"Team Response and Fund Recovery Failure","sources":[{"url":"https://www.halborn.com/blog/post/explained-the-paraluni-hack-march-2022","name":"Explained: The Paraluni Hack (March 2022) — Halborn","type":"research","credibility":2},{"url":"https://coincodecap.com/paraluni-hacked-reportedly-1-7m-lost","name":"Metaverse Project Paraluni Hacked: Reportedly $1.7M Lost — CoinCodeCap","type":"news_article","credibility":2}],"severity":"high"},{"content":"Security analysts at Halborn, CertiK, and SlowMist each independently noted that both exploited vulnerabilities — improper input validation allowing mismatched pool IDs and the absence of a reentrancy guard — belong to well-known vulnerability categories covered by standard smart contract auditing frameworks. The lack of these basic protections in a deployed production contract suggests the MasterChef contract was either not audited prior to deployment or that audit findings were not acted upon. No public audit report for the Paraluni MasterChef contract has been identified.","heading":"Security Audit Failures and Known Vulnerability Classes","sources":[{"url":"https://www.certik.com/resources/blog/4mPLWLwyKG4xy30x65uLgw-paraluni-exploit","name":"Paraluni Exploit — CertiK Blog","type":"research","credibility":2},{"url":"https://www.halborn.com/blog/post/explained-the-paraluni-hack-march-2022","name":"Explained: The Paraluni Hack (March 2022) — Halborn","type":"research","credibility":2},{"url":"https://slowmist.medium.com/paraluni-incident-analysis-58be442a4f99","name":"Paraluni Incident Analysis — SlowMist / Medium","type":"research","credibility":2}],"severity":"high"},{"content":"As of available reporting through mid-2023, no credible evidence of Paraluni resuming active operations, issuing compensation to affected users, or deploying a patched contract has been identified. The project appears to have gone dormant following the exploit. No regulatory actions or law enforcement proceedings related to this incident have been publicly reported. The attacker remains unidentified.","heading":"Current Status","sources":[{"url":"https://github.com/liqtags/crypto-rekts/blob/main/rekts/PARALUNI.md","name":"crypto-rekts PARALUNI entry — GitHub","type":"community_report","credibility":3},{"url":"https://immunebytes.com/blog/list-of-crypto-hacks-in-the-month-of-march/","name":"List of Crypto Hacks in the Month of March — ImmuneBytes","type":"research","credibility":2}],"severity":"medium"}],"timeline":[{"date":"2022-03-13","event":"Paraluni MasterChef contract exploited via reentrancy attack. Approximately $1.7 million stolen using PancakeSwap flash loans and malicious ERC-20 tokens (UBT/UGT). Attack transaction: 0x70f367b9420ac2654a5223cc311c7f9c361736a39fd4e7dff9ed1b85bab7ad54.","source":"CertiK, SlowMist, Halborn","source_url":"https://www.certik.com/resources/blog/4mPLWLwyKG4xy30x65uLgw-paraluni-exploit"},{"date":"2022-03-13","event":"PeckShield publicly identifies the exploit and attacker address (0x94bc1d555e63eea23fe7fdbf937ef3f9ac5fcf8f) via Twitter alert.","source":"PeckShield Twitter","source_url":"https://twitter.com/peckshield/status/1502817503877074947"},{"date":"2022-03-13","event":"Attacker converts stolen USDT/BUSD to BNB, cross-chains approximately 235 ETH to Ethereum via cBridge, then deposits 660 ETH into Tornado Cash across 12 transactions.","source":"SlowMist Incident Analysis","source_url":"https://slowmist.medium.com/paraluni-incident-analysis-58be442a4f99"},{"date":"2022-03-14","event":"Paraluni team publicly offers to treat the exploit as a white-hat disclosure and proposes a reward in exchange for return of funds. Attacker does not respond.","source":"Halborn / CoinCodeCap","source_url":"https://www.halborn.com/blog/post/explained-the-paraluni-hack-march-2022"}],"sources_used":[{"url":"https://www.certik.com/resources/blog/4mPLWLwyKG4xy30x65uLgw-paraluni-exploit","name":"Paraluni Exploit — CertiK Blog","type":"research","archive_url":"https://web.archive.org/web/20260724181819/https://www.certik.com/blog/4mPLWLwyKG4xy30x65uLgw-paraluni-exploit","credibility":2,"archive_timestamp":"2026-07-24T18:18:19+00:00"},{"url":"https://slowmist.medium.com/paraluni-incident-analysis-58be442a4f99","name":"Paraluni Incident Analysis — SlowMist / Medium","type":"research","archive_url":"http://web.archive.org/web/20260322055927/https://slowmist.medium.com/paraluni-incident-analysis-58be442a4f99","credibility":2,"archive_timestamp":"2026-03-22T05:59:27+00:00"},{"url":"https://www.halborn.com/blog/post/explained-the-paraluni-hack-march-2022","name":"Explained: The Paraluni Hack (March 2022) — Halborn","type":"research","archive_url":"http://web.archive.org/web/20260121042638/https://www.halborn.com/blog/post/explained-the-paraluni-hack-march-2022","credibility":2,"archive_timestamp":"2026-01-21T04:26:38+00:00"},{"url":"https://medium.com/coinmonks/hackers-exploited-reentrancy-vulnerability-to-attack-paraluni-and-made-more-than-1-7-b748843c6487","name":"Hackers exploited reentrancy vulnerability to attack Paraluni — Lunaray / Coinmonks / Medium","type":"research","archive_url":null,"credibility":2,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://coincodecap.com/paraluni-hacked-reportedly-1-7m-lost","name":"Metaverse Project Paraluni Hacked: Reportedly $1.7M Lost — CoinCodeCap","type":"news_article","archive_url":"http://web.archive.org/web/20260724175023/https://coincodecap.com/paraluni-hacked-reportedly-1-7m-lost","credibility":2,"archive_timestamp":"2026-07-24T17:50:23+00:00"},{"url":"https://www.footprint.network/daily-news/Metaverse-Project-Paraluni-Was-Hacked-and-Lost-about-$1.7M,-According-to-PeckShield-fp-622d56b4-ee0a1400-17913de9","name":"Metaverse Project Paraluni Was Hacked and Lost about $1.7M — Footprint Network","type":"news_article","archive_url":null,"credibility":2,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://bscscan.com/tx/0x70f367b9420ac2654a5223cc311c7f9c361736a39fd4e7dff9ed1b85bab7ad54","name":"Attack transaction — BscScan","type":"on_chain","archive_url":"https://web.archive.org/web/20260724174920/https://bscscan.com/tx/0x70f367b9420ac2654a5223cc311c7f9c361736a39fd4e7dff9ed1b85bab7ad54","credibility":1,"archive_timestamp":"2026-07-24T17:49:20+00:00"},{"url":"https://bscscan.com/address/0x94bc1d555e63eea23fe7fdbf937ef3f9ac5fcf8f","name":"Attacker address — BscScan","type":"on_chain","archive_url":"https://web.archive.org/web/20260724174840/https://bscscan.com/address/0x94bc1d555e63eea23fe7fdbf937ef3f9ac5fcf8f","credibility":1,"archive_timestamp":"2026-07-24T17:48:40+00:00"},{"url":"https://twitter.com/peckshield/status/1502817503877074947","name":"PeckShield alert tweet — March 13, 2022","type":"social_media","archive_url":null,"credibility":2,"archive_timestamp":null},{"url":"https://immunebytes.com/blog/list-of-crypto-hacks-in-the-month-of-march/","name":"List of Crypto Hacks in the Month of March — ImmuneBytes","type":"research","archive_url":"http://web.archive.org/web/20260410162420/https://immunebytes.com/blog/list-of-crypto-hacks-in-the-month-of-march/","credibility":2,"archive_timestamp":"2026-04-10T16:24:20+00:00"},{"url":"https://github.com/liqtags/crypto-rekts/blob/main/rekts/PARALUNI.md","name":"crypto-rekts PARALUNI entry — GitHub","type":"community_report","archive_url":null,"credibility":3,"archive_error":"error:not-found","archive_status":"unarchivable","archive_timestamp":null}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:50.903873+00:00","updated_at":"2026-08-29T01:34:18.717+00:00"}}