What happened
This record covers a counterfeit TIA token named "Celestia" at 0xCd68ACC0…e7Aa44 on Ethereum, deployed on 30 October 2023 by 0xe3cD80B7…cf02A2 and unrelated to the Celestia network. Behind obfuscated code and comments copied from OpenZeppelin, the owner-only function Address credits the token contract with however many TIA a Uniswap V2 swap needs to take 99.999% of the pair's WETH, without raising totalSupply, then swaps them to any recipient. The owner-only multicall and multicall2 functions freeze any holder's transfers or divide their balance, and there is no way to give up ownership.
On 1 November 2023 the owner called Address(0x4649F62750775220f33E0376a3CceB82f69f9527), which sold about 319.45 trillion TIA, more than a thousand times the 300 billion supply, for 115.32 WETH, about $210K according to PeckShield. The existing record says 114 ETH (208,853 USD) was then passed to another EOA and spread to 60 addresses through Disperse.app in transaction 0x84400074…056963.
How it happened
- The constructor sets
owner = msg.sender, gives the deployer all 300 billion TIA and creates the TIA/WETH pair on the Uniswap V2 router. No code writesowneragain, so ownership can never change or be renounced. Address(address _r)isonlyOwner. It computes(Sub(_RR.WETH()) * 99999) / 100000, 99.999% of the pair's WETH reserve, and asks the router withgetAmountsInhow many TIA that swap needs.- In
Allowance, an always-true condition resolvesaddress(uint160(uint256(_T())>>96))to the token contract itself, andb[...] += value[0]credits it with exactly that many TIA._totalSupplyis not changed. getContractapproves the router for the contract's whole balance andFactoryReviewcallsswapTokensForExactTokens, sending the pair's WETH to_r.multicall(bytes32[] data, uint256 _p)setsc[addr]to a positive value for each address packed intodata;_transferthen runsrequire(add(c[from], b[from]) == 0), which can never pass, so those holders cannot sell.multicall2instead rewritesb[addr]to the balance divided by_pand emits a fakeTransferto the pair.- What happened: in transaction 0x3d9a1f15…640445 (1 November 2023, 00:09:47 UTC),
Addresswas called with_r= 0x4649F627…9f9527. The token contract sent about 319.45 trillion TIA to the pair and the pair sent 115.3214 WETH to that address, dropping the price 99.5%.
Protocol details
Evidence
- report PeckShieldAlert: counterfeit Celestia $TIA dropped -99.5% twitter.com
- transaction Counterfeit TIA contract creation transaction etherscan.io
- transaction Etherscan transaction 0x3d9a1f15...0445 (Address call draining the pair) etherscan.io
- transaction etherscan.io transaction 0x8440…6963 etherscan.io
- address Celestia (TIA) counterfeit token verified contract code on Etherscan etherscan.io
- address etherscan.io address 0x4649…9527 etherscan.io
- address etherscan.io address 0xe3cD…02A2 etherscan.io
- analysis Sourcify match for 0xCd68ACC0E6C94c0226B0d760D19951143ee7Aa44 on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
