What happened
Decentralized Privacy (DPC, contract 0x8e8fe3ad…d09746) adds one function to a standard ERC-20: mint(address _to, uint256 _amount) public onlyOwner, with no cap and no supply limit. On 2020-12-22 at 19:20:09 UTC the deployer 0xBBD5730d…AE495B called mint() and created 10,000,000 DPC for 0x177641f9…dA4eA7, per Tx 1 0xada5…6eee. The same address had already sold DPC for ETH on Uniswap V2 earlier that day, between 14:38 and 14:47 UTC, for example Tx 2 0x1fcf…370f (20,000 DPC for about 0.7468 WETH, roughly $2,003 per Etherscan).
De.Fi's REKT database also lists Tx 1 0x32df…2e9e, Tx 2 0x680f…fbee and Tx 3 0x668f…eaf5 as further sales before the mint, says the minted tokens were sold afterwards, and says the calculated amounts show no significant loss to users.
How it happened
DPCTokeninheritsOwnableand definesfunction mint(address _to, uint256 _amount) public onlyOwner { emit Mint(_to,_amount); _mint(_to, _amount); }. The owner can mint any amount to any address at any time.- On 2020-12-22 between 14:38 and 14:47 UTC, address 0x177641f9…dA4eA7 sold DPC through Uniswap V2 Router 2 in several swaps (opened: 20,000 DPC for about 0.7468 WETH, 20,000 DPC for about 0.4478 WETH, 80,000 DPC for about 0.1554 WETH, USD figures per Etherscan).
- At 19:20:09 UTC the deployer, who was the owner at that time because
mintisonlyOwner, minted 10,000,000 DPC to that same address (tx 0xada5dab6…d06eee). - De.Fi's REKT database says the recipient sold the newly minted tokens as well, and that the calculated amounts show no significant loss for users.
Protocol details
Evidence
- report @WARONRUGS incident report twitter.com
- transaction Etherscan tx 0xada5dab68ca5196d6697df015f2db0f6a0e419216ed0139730971f9163d06eee (mint) etherscan.io
- transaction Etherscan tx 0x1fcfb99317fcb1dc3a838bedc79a6f9e900448a476632f8d7c64c287ac8a370f (swap) etherscan.io
- transaction Etherscan tx 0x6226ecb2c904735c4e922adee2d93c556e5490ef850eead72f3d7ff2dbb5fc3f (swap) etherscan.io
- transaction Etherscan tx 0x9264c336bf6d8de86cad5c9f03b47d4d533861cc70542a8319706d12401a5de7 (swap) etherscan.io
- transaction etherscan.io transaction 0x32df…2e9e etherscan.io
- transaction etherscan.io transaction 0x668f…eaf5 etherscan.io
- transaction etherscan.io transaction 0x680f…fbee etherscan.io
- address Etherscan verified source, Decentralized Privacy (DPC) etherscan.io
- analysis Sourcify exact match, Decentralized Privacy (DPC) repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
