{"investigation":{"slug":"yolo-games","entity_name":"YOLO Games","trust_score":28,"severity_base":null,"score_modifier":0,"confidence":0.72,"status":"published","content_type":"investigation","summary":"YOLO Games is an on-chain gambling platform built on the Blast Layer 2 network, offering high-risk games such as YOLO, Moon or Doom, and Poke the Bear, with a native $YOLO token as its reward mechanism. In June 2024, an access control vulnerability in a third-party Liquidity Bootstrapping Pool (LBP) contract was exploited, resulting in the extraction of approximately $1.387 million, of which 90% was subsequently returned by the attacker acting as a whitehat. The $YOLO token has since collapsed approximately 99.6% from its all-time high and the protocol shows near-zero fee activity as of 2025-2026, suggesting severe user attrition or effective abandonment.","sections":[{"content":"YOLO Games describes itself as 'the home of degen gaming' and operates on Blast, an Ethereum Layer 2 network. The platform offers several provably fair on-chain games — YOLO, Moon or Doom, Poke the Bear, Flipper, Quantum, Laser Blast, and Don't Fall In — in which players wager ETH or other supported tokens against a liquidity pool. Fees of 1-3% are taken per game round and distributed to liquidity providers and token holders. The native $YOLO token (contract: 0x57cad9fe0b46c895f3e470ed971946112722d9ee on Blast) was launched in June 2024 following a season of points accumulation tied to gameplay. LooksRare, an NFT marketplace, is identified as a core contributor to the project, with 2.5% of the initial $YOLO supply allocated to LOOKS token stakers. The team behind YOLO Games operates anonymously and has not publicly disclosed individual identities, describing themselves broadly as a 'veteran team with a track record of delivering provably fair, fun on-chain games.'","heading":"Platform Overview","sources":[{"url":"https://yologames.io/","name":"yologames.io","type":"other","credibility":3},{"url":"https://docs.yologames.io/","name":"docs.yologames.io","type":"other","credibility":3},{"url":"https://docs.looksrare.org/blog/ready-to-claim-your-yolo","name":"docs.looksrare.org","type":"other","credibility":3},{"url":"https://www.coinlive.com/news-flash/453936","name":"coinlive.com","type":"other","credibility":3},{"url":"https://blastscan.io/token/0x57cad9fe0b46c895f3e470ed971946112722d9ee","name":"blastscan.io","type":"other","credibility":3}],"severity":"medium"},{"content":"On June 10, 2024, an attacker exploited an access control vulnerability in the Bazaar LBP (Liquidity Bootstrapping Pool) smart contract being used by YOLO Games for its token launch. The vulnerable function, exitPool(), lacked a permission check that would verify whether the caller was the actual owner of the sender address. The attacker passed the address of the BazaarLBPFactoryBlast contract (0xb66585C4E460D49154D50325CE60aDC44bc900E9) as the sender parameter without ownership verification, enabling unauthorized withdrawal of pool assets. On June 9, the project had deposited 354 ETH and 888,888,888 YOLO tokens into the Bazaar pool. On June 10, the exploiter (address: 0x3cf5B87726Af770c94494E886d2A69c42A203884) called exitPool() against the vulnerable contract (0xdC4A9779D6084C1ab3e815B67eD5e6780cCF4d90), withdrawing approximately 392.37 ETH and 880,539,680 rYOLO tokens, totaling roughly $1.387 million at the time. Within three minutes of the exploit, the attacker contacted the project to negotiate a return of funds. Approximately 353 ETH (roughly 90% of the value, approximately $1.274 million) was returned to the project, with the attacker retaining approximately 10% (~$137,000) as an informal whitehat bounty. YOLO Games terminated the LBP sale early and subsequently issued ETH refunds to all qualifying sale participants. CertiK published a technical incident analysis confirming these details. The Cantina security competition covering YOLO Games' own game contracts ran May 27 to June 8, 2024 — just days before the exploit — but the vulnerable Bazaar LBP contract was a third-party dependency and was not in scope for that review.","heading":"June 2024 Smart Contract Exploit","sources":[{"url":"https://www.certik.com/resources/blog/yolo-games-bazaar-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://www.coinlive.com/news-flash/538579","name":"coinlive.com","type":"other","credibility":3},{"url":"https://www.quadrigainitiative.com/hackfraudscam/yologamesliquidityexitpoolcheckmissing.php","name":"quadrigainitiative.com","type":"other","credibility":3},{"url":"https://x.com/CertiK/status/1808044617129926877","name":"x.com","type":"other","credibility":3},{"url":"https://smartcontractshacking.com/hacks/yolo-games-hack-2024","name":"smartcontractshacking.com","type":"other","credibility":3},{"url":"https://cantina.xyz/competitions/a2c3cc6a-e384-495f-9751-5d7e657bc219","name":"cantina.xyz","type":"other","credibility":3},{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2024","name":"halborn.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The $YOLO token launched in June 2024 and reached an all-time high of approximately $0.008230 on June 16, 2024. As of early 2026, the token trades at approximately $0.00003157 — a decline of roughly 99.6% from its peak. The fully diluted valuation stood at approximately $280,000 with a total supply of 8,888,888,888 tokens. Trading is limited to a single market on the Thruster V3 decentralized exchange (YOLO/WETH on Blast), with 24-hour volume as low as $2.17 in early 2026. DeFiLlama data shows cumulative protocol fees of approximately $22.5 million historically, but 7-day and 24-hour fees have collapsed to $0, indicating near-complete user attrition. The protocol holds $0 TVL as of 2026. CoinGecko notes trading has effectively ceased on all tracked exchanges, and the token's all-time low of approximately $0.00003113 was reached on February 11, 2026.","heading":"Token Performance and Protocol Decline","sources":[{"url":"https://www.coingecko.com/en/coins/yolo-games","name":"coingecko.com","type":"other","credibility":3},{"url":"https://defillama.com/protocol/yolo-games","name":"defillama.com","type":"other","credibility":3},{"url":"https://cryptorank.io/price/yolo-games","name":"cryptorank.io","type":"other","credibility":3},{"url":"https://dexscreener.com/blast/0x24ff700b6525c9889a0545d1c11baf9f2bf442e7","name":"dexscreener.com","type":"other","credibility":3}],"severity":"medium"},{"content":"The YOLO Games team operates anonymously and has not disclosed the identities of its founders or core developers. The project identifies LooksRare as a 'core contributor,' which provides some indirect accountability; LooksRare is a known NFT platform with a prior public presence. However, the broader YOLO Games team is described only as a 'veteran team' with no verifiable attribution. The project's documentation contains no visible risk disclosures, responsible gaming notices, or warnings about the speculative nature of the $YOLO token or the gambling products offered. The platform explicitly incentivizes higher-risk gameplay, stating that 'the higher-risk moves will yield the most Points.' Anonymous team structures are an elevated risk factor in on-chain gaming and gambling protocols, as they reduce accountability in the event of fund loss, regulatory action, or project abandonment.","heading":"Team Anonymity and Transparency Concerns","sources":[{"url":"https://docs.yologames.io/","name":"docs.yologames.io","type":"other","credibility":3},{"url":"https://docs.looksrare.org/blog/ready-to-claim-your-yolo","name":"docs.looksrare.org","type":"other","credibility":3},{"url":"https://messari.io/project/yolo-games/profile","name":"messari.io","type":"other","credibility":3},{"url":"https://theblock101.com/what-is-yolo-games","name":"theblock101.com","type":"other","credibility":3}],"severity":"medium"},{"content":"YOLO Games operates as an unlicensed on-chain crypto gambling platform. The platform is accessible globally and does not appear to implement geographic restrictions, KYC, or age verification, which is common to unregulated crypto gambling protocols. The broader Blast ecosystem — on which YOLO Games is built — attracted significant scrutiny in 2024 due to multiple exploits and rug pulls among ecosystem projects, including the RiskOnBlast rug pull ($1.3 million) and the Munchables exploit ($62 million). While YOLO Games itself is a distinct project from these incidents, the shared ecosystem context contributed to elevated risk perception. No formal regulatory action has been identified against YOLO Games specifically. The on-chain gambling model, anonymous team, lack of consumer protections, and lack of licensing represent ongoing regulatory exposure, particularly as global regulators increase scrutiny of crypto-native gambling platforms.","heading":"Regulatory Environment and Gambling Risk","sources":[{"url":"https://www.coindesk.com/markets/2024/02/26/blast-ecosystem-sees-first-apparent-scam-as-riskonblast-rug-pulls-13m-ether","name":"coindesk.com","type":"other","credibility":3},{"url":"https://igamingbusiness.com/strategy/yolo-group-pivot-regulated-markets/","name":"igamingbusiness.com","type":"other","credibility":3},{"url":"https://docs.yologames.io/","name":"docs.yologames.io","type":"other","credibility":3}],"severity":"medium"},{"content":"YOLO Games held a crowdsourced security competition on Cantina from May 27 to June 8, 2024, covering 10 Solidity contracts (approximately 2,057 source lines of code) with a prize pool of $27,500. The scope covered the core game contracts: Flipper, Quantum, Laser Blast, Don't Fall In, and the LiquidityPoolRouter. A total of 199 findings were submitted. Notably, admin and permissioned functions were explicitly excluded from scope, meaning the governance and access control surface of the protocol received reduced third-party scrutiny. The Bazaar LBP contract that was ultimately exploited was a third-party dependency and was not covered by this competition. CertiK monitored the June 2024 incident and published an on-chain incident analysis. Whether a full audit of the YOLO Games core contracts by CertiK or another firm was completed prior to launch has not been confirmed in publicly available sources.","heading":"Security Audit History","sources":[{"url":"https://cantina.xyz/competitions/a2c3cc6a-e384-495f-9751-5d7e657bc219","name":"cantina.xyz","type":"other","credibility":3},{"url":"https://www.certik.com/resources/blog/yolo-games-bazaar-incident-analysis","name":"certik.com","type":"other","credibility":3},{"url":"https://x.com/CertiK/status/1808044617129926877","name":"x.com","type":"other","credibility":3}],"severity":"medium"}],"timeline":[{"date":"2024-02-29","event":"YOLO Games completes a token snapshot at Blast block height 19332142 for Season 1 airdrop eligibility.","source":""},{"date":"2024-05-27","event":"Cantina security competition for YOLO Games' core smart contracts begins, covering 10 Solidity contracts with a $27,500 prize pool.","source":""},{"date":"2024-06","event":"YOLO Games publicly launches on Blast mainnet.","source":"","date_original":"2024-06-01"},{"date":"2024-06-08","event":"Cantina security competition closes with 199 findings submitted.","source":""},{"date":"2024-06-09","event":"YOLO Games deposits 354 ETH and 888,888,888 YOLO tokens into the Bazaar LBP smart contract for the token launch sale.","source":""},{"date":"2024-06-10","event":"Attacker exploits the exitPool() function in the Bazaar LBP contract — a missing permission check allows extraction of approximately 392 ETH and 880,539,680 rYOLO tokens (~$1.387M). Attacker contacts project within minutes to negotiate return.","source":""},{"date":"2024-06-11","event":"YOLO Games announces early termination of the LBP sale due to the security flaw. The attacker returns approximately 353 ETH (~90% of stolen value). YOLO Games commits to ETH refunds for qualifying LBP sale participants.","source":""},{"date":"2024-06-12","event":"YOLO Games proceeds with Token Generation Event (TGE) on a revised plan. $YOLO token begins trading.","source":""},{"date":"2024-06-16","event":"$YOLO token reaches its all-time high of approximately $0.008230.","source":""},{"date":"2026-02-11","event":"$YOLO token reaches its all-time low of approximately $0.00003113, approximately 99.6% below its peak.","source":""},{"date":"2026-02-11","event":"Protocol shows $0 TVL and $0 weekly fees on DeFiLlama, indicating near-complete cessation of user activity.","source":""}],"sources_used":[{"url":"https://yologames.io/","name":"yologames.io","type":"other","archive_url":"http://web.archive.org/web/20260521143712/https://yologames.io/","credibility":3,"archive_timestamp":"2026-05-21T14:37:12+00:00"},{"url":"https://docs.yologames.io/","name":"docs.yologames.io","type":"other","archive_url":"http://web.archive.org/web/20260417003354/https://docs.yologames.io/","credibility":3,"archive_timestamp":"2026-04-17T00:33:54+00:00"},{"url":"https://docs.looksrare.org/blog/ready-to-claim-your-yolo","name":"docs.looksrare.org","type":"other","archive_url":"http://web.archive.org/web/20260829133310/https://docs.looksrare.org/blog/ready-to-claim-your-yolo","credibility":3,"archive_timestamp":"2026-08-29T13:33:10+00:00"},{"url":"https://www.coinlive.com/news-flash/453936","name":"coinlive.com","type":"other","archive_url":"https://web.archive.org/web/20260829150202/https://www.coinlive.com/news-flash/453936","credibility":3,"archive_timestamp":"2026-08-29T15:02:02+00:00"},{"url":"https://blastscan.io/token/0x57cad9fe0b46c895f3e470ed971946112722d9ee","name":"blastscan.io","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.certik.com/resources/blog/yolo-games-bazaar-incident-analysis","name":"certik.com","type":"other","archive_url":"http://web.archive.org/web/20251016170029/https://www.certik.com/resources/blog/yolo-games-bazaar-incident-analysis","credibility":3,"archive_timestamp":"2025-10-16T17:00:29+00:00"},{"url":"https://www.coinlive.com/news-flash/538579","name":"coinlive.com","type":"other","archive_url":"https://web.archive.org/web/20260830004728/https://www.coinlive.com/news-flash/538579","credibility":3,"archive_timestamp":"2026-08-30T00:47:28+00:00"},{"url":"https://www.quadrigainitiative.com/hackfraudscam/yologamesliquidityexitpoolcheckmissing.php","name":"quadrigainitiative.com","type":"other","archive_url":"https://web.archive.org/web/20260829153042/https://www.quadrigainitiative.com/hackfraudscam/yologamesliquidityexitpoolcheckmissing.php","credibility":3,"archive_timestamp":"2026-08-29T15:30:42+00:00"},{"url":"https://x.com/CertiK/status/1808044617129926877","name":"x.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://smartcontractshacking.com/hacks/yolo-games-hack-2024","name":"smartcontractshacking.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://cantina.xyz/competitions/a2c3cc6a-e384-495f-9751-5d7e657bc219","name":"cantina.xyz","type":"other","archive_url":"http://web.archive.org/web/20260421144000/https://cantina.xyz/competitions/a2c3cc6a-e384-495f-9751-5d7e657bc219","credibility":3,"archive_timestamp":"2026-04-21T14:40:00+00:00"},{"url":"https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2024","name":"halborn.com","type":"other","archive_url":"http://web.archive.org/web/20260517002219/https://www.halborn.com/blog/post/month-in-review-top-defi-hacks-of-june-2024","credibility":3,"archive_timestamp":"2026-05-17T00:22:19+00:00"},{"url":"https://www.coingecko.com/en/coins/yolo-games","name":"coingecko.com","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://defillama.com/protocol/yolo-games","name":"defillama.com","type":"other","archive_url":"http://web.archive.org/web/20251026201634/https://defillama.com/protocol/yolo-games","credibility":3,"archive_timestamp":"2025-10-26T20:16:34+00:00"},{"url":"https://cryptorank.io/price/yolo-games","name":"cryptorank.io","type":"other","archive_url":"https://web.archive.org/web/20260830042332/https://cryptorank.io/price/yolo-games","credibility":3,"archive_timestamp":"2026-08-30T04:23:32+00:00"},{"url":"https://dexscreener.com/blast/0x24ff700b6525c9889a0545d1c11baf9f2bf442e7","name":"dexscreener.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-request","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://messari.io/project/yolo-games/profile","name":"messari.io","type":"other","archive_url":null,"credibility":3,"archive_timestamp":null},{"url":"https://theblock101.com/what-is-yolo-games","name":"theblock101.com","type":"other","archive_url":null,"credibility":3,"archive_error":"error:no-job","archive_status":"unarchivable","archive_timestamp":null},{"url":"https://www.coindesk.com/markets/2024/02/26/blast-ecosystem-sees-first-apparent-scam-as-riskonblast-rug-pulls-13m-ether","name":"coindesk.com","type":"other","archive_url":"http://web.archive.org/web/20260311012502/https://www.coindesk.com/markets/2024/02/26/blast-ecosystem-sees-first-apparent-scam-as-riskonblast-rug-pulls-13m-ether","credibility":3,"archive_timestamp":"2026-03-11T01:25:02+00:00"},{"url":"https://igamingbusiness.com/strategy/yolo-group-pivot-regulated-markets/","name":"igamingbusiness.com","type":"other","archive_url":"http://web.archive.org/web/20250930140719/https://igamingbusiness.com/strategy/yolo-group-pivot-regulated-markets/","credibility":3,"archive_timestamp":"2025-09-30T14:07:19+00:00"}],"source_tags":["defillama"],"addresses":[],"reviewed":false,"reviewed_by":null,"model_used":"claude-sonnet-4-6","created_at":"2026-05-04T02:54:31.739282+00:00","updated_at":"2026-08-30T05:14:07.636128+00:00"}}