CYBER SOLIDITY Rug Pull

Reported loss $8K
Ethereum
Rugpull

What happened

CYI only lets a short list of addresses call transfer, and only its hard-coded creator address can call approve. The Uniswap router and the pair get onto the list automatically when tokens are moved into the pair, so liquidity can be added and buyers can receive tokens from the pair, but an ordinary buyer is never listed and cannot approve the router, so a sell through Uniswap reverts. Etherscan shows the creator address 0xEeE9Fe48…f7b4a5 adding 20.5 ETH and 3,500 CYI to a new pair at 06:49:04 UTC on 2020-11-14 (transaction 0x9fe148dc…5ce2ce, LP tokens minted to itself) and removing that liquidity at 07:50:55 UTC (transaction 0x35f1cdac…c0ebbc), receiving 37.43 WETH and 1,921.98 CYI.

De.Fi's REKT database lists the difference between initial and final liquidity as 19.9 ETH, and states the funds were moved to another address and deposited into the Binance exchange.

How it happened

  1. The constructor hard-codes the creator and gives it the full 6,000 CYI supply: _creator = 0xEeE9Fe48C1FFB4AAAEB288B60CC48E5F58f7b4a5; and _balances[creator()] = _totalSupply;. The creator and the Uniswap router are marked permitted.
  2. transfer carries the modifier onlyPermitted, which requires _permitted[_msgSender()]. approve, increaseAllowance and decreaseAllowance are onlyCreator. When the router calls transferFrom it runs givePermissions(recipient), which lists the pair as soon as liquidity is added.
  3. The creator added 20.5 ETH and 3,500 CYI at 06:49:04 UTC (transaction 0x9fe148dc…5ce2ce) and received the LP tokens.
  4. Buyers receive tokens from the pair through transfer, and the pair is permitted, so buys succeed. A buyer is not permitted and cannot call approve. A sell through the router needs transferFrom(holder, pair, amount), where the allowance check _allowances[sender][_msgSender()].sub(amount, ...) reverts because the holder's allowance is 0 and nobody but the creator can raise it. A direct transfer by the holder also reverts at onlyPermitted.
  5. At 07:50:55 UTC the creator called removeLiquidityETHWithPermit (transaction 0x35f1cdac…c0ebbc), burned about 267.86 LP tokens and received 37.43 WETH and 1,921.98 CYI. The pool had held 20.5 ETH and 3,500 CYI after step 3, so the creator took out about 16.9 ETH more than it put in.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract CYI

Evidence

Same attack technique

Browse all hacks →
Ethereum SAV3R $10K lost Ethereum Walletreum $138K lost Ethereum YFFC $72K lost Ethereum Bloody Finance $1K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes