Abattoir of Zir Rug Pull

Reported loss $226K
Rugpull

What happened

Abattoir of Zir (DIABLO) was an ERC-20 token on Ethereum at 0x1a59BE24…e574dB, deployed on 5 December 2023 by 0x1bA6969b…Fbf2Df. Behind comments copied from OpenZeppelin, its owner-only function Address credits the token contract with as many DIABLO as a Uniswap V2 swap needs to take 99.999% of the pool's WETH, without raising totalSupply, and swaps them to any recipient. Two other owner-only functions, multicall and multicall2, can freeze any holder's transfers or divide their balance, and the contract has no way to change or give up ownership.

On 6 December 2023 the deployer called Address(0x4649F62750775220f33E0376a3CceB82f69f9527), which sold about 785.4 billion DIABLO, nearly 7,900 times the 100 million supply, for 104.74 WETH, about $235.5K according to PeckShield. The existing record says the funds were then passed to further addresses through Disperse.app.

How it happened

  1. The constructor sets owner = msg.sender, gives the deployer all 100,000,000 DIABLO and creates the DIABLO/WETH pair on the Uniswap V2 router. No function writes owner again.
  2. Address(address _r) is onlyOwner. It computes (Sub(_RR.WETH()) * 99999) / 100000, 99.999% of the pair's WETH reserve, and asks the router with getAmountsIn how many DIABLO that swap needs.
  3. In Allowance, an always-true condition resolves address(uint160(uint256(_T()) >> 96)) to the token contract itself, and b[...] += value[0] credits it with exactly that many DIABLO. _totalSupply is not changed.
  4. getContract approves the router for the contract's whole balance and FactoryReview calls swapTokensForExactTokens, sending the pair's WETH to _r.
  5. multicall(bytes32[] data, uint256 _p) sets c[addr] to a positive value for each address packed into data; _transfer then runs require(add(c[from], b[from]) == 0), which can never pass, so those holders cannot sell. multicall2 instead rewrites b[addr] to the balance divided by _p and emits a fake Transfer to the pair.
  6. What happened: in transaction 0x5dcf195b…a0ec00 (6 December 2023, 22:50:23 UTC), the deployer called Address with _r = 0x4649F627…9f9527. The token contract sent about 785.40 billion DIABLO to the pair and the pair sent 104.7398 WETH to that address. PeckShield reported the price down 100%.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract DIABLO

Evidence

Same attack technique

Browse all hacks →
EI Risitas $52K lost Strong Finance $61K lost CKD TOKEN $485K lost CoinPanda_ETH $81K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes