Skip to main content
AVOID.NET

Paraluni Masterchef

avoid.net/paraluni-masterchef→49/100·82% conf.
[AI-DRAFTED · AWAITING FACT-CHECK][src:defillama]

Last changed 2026-10-10 · Score recalculated — Rescored under Scoring v2, the published formula (avoid.net/scoring): 18 → 49. Problems weighed by who is responsible: incidents the subject suffered −20, concerns that are not fraud −6, problems around the subject, caused by others −0.3; the penalty for incidents it suffered is capped at 20. Version history →

Why this score
Every page starts at65
Concerns that are not fraud-6
Incidents it suffered (e.g. hacks)-20
Problems around it, caused by others-0.3
Sum39
  • The penalty for incidents it suffered is capped at 20 points.

Score: 49/100 (kept between 0 and 100)

How scoring works →
anchored·4nrNnT…eFLr
Submit evidence

Summary

Paraluni is a metaverse DeFi yield-farming protocol deployed on Binance Smart Chain (BSC). On March 13, 2022, its MasterChef smart contract was exploited via a reentrancy vulnerability in the depositByAddLiquidity function, resulting in approximately $1.7 million in losses. The attacker laundered the proceeds through Tornado Cash and never returned funds despite a public appeal from the Paraluni team.

Connected Entities

3 entities · 60 linked investigations
Organizations
□Ethereum90□Binance24□Paraluni Masterchef
Relationships
  • Binance→mentioned with→Ethereum(65%)
  • Paraluni Masterchef→mentioned with→Ethereum(70%)
  • Paraluni Masterchef→mentioned with→Binance(65%)
Also appears in
BNB Chain Bridge·51AI-Powered Crypto Phishing Infrastructure 2026·0CoinDCX·62Compounder Finance·0Binance·24Chads NFT·69Socket Protocol·66Lendf.me·50Bankr·63FOMO Token·8
Have evidence about Paraluni Masterchef?

Timeline(4 events)

13 March 2022

Paraluni MasterChef contract exploited via reentrancy attack. Approximately $1.7 million stolen using PancakeSwap flash loans and malicious ERC-20 tokens (UBT/UGT). Attack transaction: 0x70f367b9420ac2654a5223cc311c7f9c361736a39fd4e7dff9ed1b85bab7ad54.

CertiK, SlowMist, Halborn

13 March 2022

PeckShield publicly identifies the exploit and attacker address (0x94bc1d555e63eea23fe7fdbf937ef3f9ac5fcf8f) via Twitter alert.

PeckShield Twitter

13 March 2022

Attacker converts stolen USDT/BUSD to BNB, cross-chains approximately 235 ETH to Ethereum via cBridge, then deposits 660 ETH into Tornado Cash across 12 transactions.

SlowMist Incident Analysis

14 March 2022

Paraluni team publicly offers to treat the exploit as a white-hat disclosure and proposes a reward in exchange for return of funds. Attacker does not respond.

Halborn / CoinCodeCap
Provenance & Audit Trail
Recorded on Solana ✓Verify on-chain7 Wayback Archivessrc:defillama

Decision Log

  • #2rescore+31Recorded on Solana ✓10/10/2026, 6:43:12 PM
    slot 455363300 · hash Aw6c8midHsvpHhwPYxyqPZcpmNhDMXYdMQFbdBNqTnDH
  • #1publishRecorded on Solana ✓5/28/2026, 3:51:51 PM
    slot 422751069 · hash DBnnCHsB6LAX3E9MEPuLzDw7TDKChS5ofwDDAVjqWw9y

This investigation is cryptographically anchored to the Solana blockchain (2 decisions). 7 of 11 cited source URLs have an Internet Archive snapshot.

full audit log →version history →

model: claude-sonnet-4-6

generated: 5/4/2026, 2:54:50 AM

last updated: 10/10/2026, 6:43:12 PM

6 views

avoid.net — verified advice for a post-truth world