What Happens When a Yield Farming Protocol Rug Pulls?
Staked funds sit inside the farming contract itself — which means a rug pull here doesn't need to touch any liquidity pool at all. Here's how it works.
A yield farm adds an extra layer on top of a standard rug pull — deposited funds aren't just sitting in a simple liquidity pool, they're locked into a farming contract, which changes both how the exit happens and how much can be taken at once.
Why Farming Contracts Hold More Than a Typical Pool
A yield farm's smart contract holds every depositor's staked funds directly, often across multiple different pools or "farms" simultaneously. This can mean a single contract controls a considerably larger, more concentrated amount of value than a single standard liquidity pool would.
How a Farming Rug Pull Typically Executes
Rather than withdrawing liquidity from a trading pool, a malicious farming contract can include a function allowing the contract owner to withdraw all staked user funds directly — sometimes disguised as an "emergency withdrawal" or "admin" function that exists in the code from the start, activated once deposits reach a worthwhile amount.
Why This Can Happen Even Without Touching Any Trading Pool
Because staked funds sit inside the farming contract itself rather than a separate liquidity pool, this type of rug pull doesn't require the same liquidity-lock mechanics that protect against a standard pool drain — a liquidity lock on the underlying trading pair does nothing to prevent the farming contract itself from having an exploitable admin function.
Why High-APY Farms Are Disproportionately Targeted for This
Farms advertising unusually high returns attract deposits quickly, meaning the contract accumulates a worthwhile amount to drain in a shorter window — the same extreme-APY pattern that raises sustainability concerns also concentrates more value into a shorter, riskier period.
Why Auto-Compounding Features Can Make This Worse
Some farms automatically reinvest earned rewards back into the staked position, growing a user's exposure without requiring any further action — meaning funds can accumulate to a larger, more exploitable amount without the depositor actively adding anything themselves.
What Happens to Deposited Funds When This Occurs
Depositors typically see their staked balance reflected accurately right up until the exploit, at which point an attempt to withdraw either fails outright or returns nothing, since the underlying funds the contract was supposed to be holding have already been removed.
What to Check Before Staking in Any Farming Contract
Whether the farming contract has been independently audited specifically (separate from any audit of the underlying token itself), whether an emergency withdrawal or admin function exists and who controls it, and how long the specific farming contract — not just the associated token — has operated without incident.
Check a farming contract's permissions and audit status separately from the token itself — staking adds a second layer of contract risk beyond whatever the token's own contract already carries.