🚨 We found a serious loophole in RugPull Bakery Season 7.
TL;DR: This is a scalable farming loophole. Non-AGW wallets can bypass the frontend, register directly, and farm with ~7% lower gas costs than normal AGW users. One wallet is the proof; the real problem is that this can be multiplied into a full sybil farm unless AGW validation is enforced on-chain.
The docs say “AGW-Only Signup”, but the wallet 0x0638D5c5b1946B530Ac69D3ae00Bcfb175f434d7 is registered as a Season 7 player while not being an AGW.
They did not sign up through the Portal UI. Instead, they bypassed the frontend and called the registration contract directly using a custom minimal ZKsync native account. The account bytecode is only ~1,632 bytes, while a standard AGW is much larger.
This matters because it creates a real competitive advantage. Their bake transaction uses around 135,773 gas, while a normal AGW bake transaction uses around 146,208 gas. That is roughly 7% cheaper per bake, and at 100k–150k bakes per season, this difference compounds into a meaningful ETH advantage.
This does not look like a random wallet either. The funding path goes from an unknown chain through
Relay.link, then to a collector wallet 0x2ea906..., then 8 ETH to the deployer 0x5f28d21b85d659585a74ebb29c88b80b5f233003, and finally 0.15 ETH through the AGW Factory to the Bakery bot wallet 0x0638....
The upstream funding appears connected to 21 high-nonce MEV / arbitrage bots with 40k–50k nonce activity, plus funds cycling back through Gaslite Drop-style mass refuels. In other words, this looks like a professional anonymous MEV setup that has been active on Abstract since January 2025, not a casual player.
To be clear, this is not “hacking”. It is an on-chain validation gap. If Season 7 signup is meant to be AGW-only, then AGW validation should be enforced in the registration contract itself, not only in the frontend.
Deploy tx:
abscan.org/tx/0x9f4c50c430c5…
Deployer:
abscan.org/address/0x5f28d21…
The key question for the team: was this an intended loophole, or should non-AGW registrations be revoked before this gets abused at scale?