Bare Bear Rug Pull

Reported loss $202K
Rugpull

What happened

Bare Bear (BEAR) is an ERC-20 token deployed on Ethereum on 24 July 2023 at 0x9d41227c…e77009, with 6,599,565,555 tokens minted to the deployer 0x65bC21A4…EEBf75. Its constructor sets owner() to the zero address, so it looks renounced, but it also stores a hidden address, 0x66fcf45f…9094af. That address can freeze any holder through a function named Approve (capital A), and anyone can call a public addLiquidity function to credit it with unlimited tokens without changing total supply or emitting a Transfer event.

On 25 July 2023 at 03:46 UTC the deployer withdrew its Uniswap V3 liquidity position in transaction 0xdfd24972…905322, receiving about 109.51 ETH and 2.51 billion BEAR. Cyvers valued the removal at $202.8K and reported the ETH was moved through other addresses to 0x6f7c8980…b352ff; De.Fi's REKT database says it was spread across four wallets.

How it happened

  1. The Ownable constructor calls _setOwner(address(0)), so owner() is the zero address from deployment and no onlyOwner function can run.
  2. The BareBear constructor stores the token_ argument as a hidden role, _tokin.addr = token_; Sourcify's constructor arguments show it is 0x66fcf45f…9094af. The deployer receives the full 6,599,565,555 BEAR supply.
  3. Approve(address spender, uint256 amount) only acts when the caller is that hidden address: with amount > 0 it sets _decenEx[spender] = spender, flagging the holder.
  4. Every transfer first runs _chabalen. For a flagged sender it sets amount = _totSu and calls _mins(sender, amount), subtracting the whole total supply from the sender's balance, which underflows and reverts under Solidity 0.8.19. A flagged holder cannot sell or move tokens.
  5. addLiquidity(address lpToken, uint256 amount, bool canTrad) is public. When lpToken is the hidden address, it subtracts total while total is still 0, then adds amount to the hidden address's balance, so any caller can credit it with any amount; _totSu is unchanged and no Transfer event is emitted.
  6. The recorded loss came from liquidity: in transaction 0xdfd24972…905322 the deployer called multicall on the Uniswap V3 position manager and withdrew about 109.51 ETH and 2.51 billion BEAR.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract BEAR

Evidence

Same attack technique

Browse all hacks →
SafeMoonX $25K lost Terk The Gorilla $122K lost Worldcoin $330K lost ROACH RACE $160K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes