What happened
DEFIBase (DEFIB) is a rebasing token whose code starts with all transfers paused and gives the owner control over who may move tokens and over which address can rebase or mint shares. initialize() sets transfersPaused = true with only the owner on transferPauseExemptList, and the owner can later change the flag, add exemptions, and point monetaryPolicy at any address, which can then call rebase, mintShares and burnShares. The live record, drawing on the De.Fi listing, says DEFIBase is a fork of the Base project, that an error in calling the rebase function returned the current token price instead of the initial one, that a manual call to the price rebase method failed 280 transactions for the developers, that the Telegram chat was muted for the community, and that 696 ETH was withdrawn from the general pool in a series of transactions; victims' negative comments are listed at the Etherscan comments page of 0xfda2dca8…bac1a3.
The pool and the price logic are in contracts outside the supplied token source, and the proof tweet was not retrievable, so those events are attributed to the listing and not independently confirmed.
How it happened
initialize()gives the whole supply to the owner and starts the token locked:_shareBalances[owner()] = _totalShares;,transfersPaused = true;,transferPauseExemptList[owner()] = true;. Initial supply is 5,000,000 tokens (INITIAL_SUPPLY = 5000000 * 10**DECIMALS).- While paused,
transfer,transferFrom,approve,increaseAllowanceanddecreaseAllowanceall begin withrequire(!transfersPaused || transferPauseExemptList[msg.sender], "paused");. The check is on the caller, so a non-exempt holder cannot even approve a router and a non-exempt contract cannot pull tokens withtransferFrom. - The owner controls the lock:
function setTransfersPaused(bool _transfersPaused) public onlyOwner,function setTransferPauseExempt(address user, bool exempt) public onlyOwner. The code allows a state where chosen addresses (for example a pool pair, as caller oftransferon buys) can move tokens while ordinary holders cannot approve or sell; whether that state existed during the incident is not shown by any opened transaction. - The owner can also set the monetary policy address to any account:
function setMonetaryPolicy(address monetaryPolicy_) external onlyOwner { monetaryPolicy = monetaryPolicy_; ... }. That address alone may callrebase, which changes_totalSupplyby any signedsupplyDelta(limited only byMAX_SUPPLY) and recomputes_sharesPerDEFIBASE = _totalShares.div(_totalSupply), rescaling every holder's balance. - The same address may mint shares without limit:
function mintShares(address recipient, uint256 amount) public { require(msg.sender == monetaryPolicy, "forbidden"); _shareBalances[recipient] = _shareBalances[recipient].add(amount);.balanceOfdivides shares by_sharesPerDEFIBASE, so minted shares appear as a balance, andrebasesPaused(owner-set) can freeze rebases. - Per the De.Fi listing, the rebase call misbehaved, the developers' manual price rebase failed 280 times and 696 ETH left the general pool; those steps run in the external policy and pool contracts and are not visible in this token's code.
Protocol details
Evidence
- report @WARONRUGS incident report twitter.com
- address DEFIBase (DEFIB) verified contract source, Etherscan etherscan.io
- address etherscan.io address 0xfda2…ents etherscan.io
- analysis de.fi Analysis t.me
- analysis Web Archive web.archive.org
- analysis Sourcify match, chain 1, 0x154f0dce06eb0e7ea5d6cf1bc70039ca22b5fb17 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
