What happened
Dogioh (contract 0x790540Ff…611355) has an unlimited mint function open to any holder of MINTER_ROLE, a role granted to the deployer at construction, plus a burn(address,uint256) that a BURNER_ROLE holder can use on any address without an allowance. Nothing in the code caps supply or delays either power.
On 2022-08-22 a CertiK Community Alert reported a rug pull on Dogioh with the price down more than 99%, saying tokens were minted in 2 transactions and sold for 65K USDC, and that the funds were moved to an address starting 0x345C. De.Fi's REKT database lists the team as taking 65,000 USD in profit and lists the token deployer as the scammer address.
Scammer address, token deployer, as listed by De.Fi: 0x81bd8c2f…8dbfdf
How it happened
- The constructor gives the deployer every control role:
_grantRole(DEFAULT_ADMIN_ROLE, msg.sender);_grantRole(MINTER_ROLE, msg.sender);_grantRole(BURNER_ROLE, msg.sender);. mint(address to, uint256 amount) public onlyRole(MINTER_ROLE)calls_mint(to, amount)with no supply cap, so a role holder can create any quantity of new tokens and send them to any address.burn(address _from, uint256 _amount) public onlyRole(BURNER_ROLE)calls_burn(_from, _amount)with no allowance check, so a role holder can destroy any address's balance.setAdminandsetMinterlet an existing admin hand the same powers to more addresses. Transfers by non-whitelisted addresses also route a1/feeDivisorshare tofeeAddress, which the admin can change withsetFeeAddress; the sender is debited the full amount.- What happened, per CertiK's Community Alert: the price fell more than 99% after tokens were minted in 2 transactions and sold for 65K USDC, and the funds were moved to another address. Any mint required an account holding
MINTER_ROLE; the alert as opened does not say which account sent the mints.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
