What happened
Doodle Monkey (MONKEY) is an ERC721A NFT collection of 1,222 tokens at 0.029 ETH each whose mint payments sit in the contract, and an owner-only withdraw() sends the entire ETH balance to the caller with no timelock, refund path or vesting. On 2022-03-23 at 05:36:49 UTC, the deployer and owner, 0x1C22C18F…943672, called withdraw() and received 25.491 ETH from the contract (transaction 0x10ac9787…db7a07). The same address then sent 7 ETH (transaction 0x59fd806a…db438d), 5.2 ETH (transaction 0x1654c33a…954c31) and 7 ETH (transaction 0x8dcce798…7746e0) to two external addresses, 19.2 ETH in total.
A Telegram post from the Crypto Vigilante channel flagged the project as appearing to be a scam, saying its Discord and website links disappeared from its Twitter bio after minting and that users asking questions were banned. De.Fi's REKT database lists the incident as an exit scam/rugpull of 75,555 USD.
How it happened
**What the code allows**
- Buyers call
function mint(address _to, uint256 _count) external payable, which checksrequire(msg.value >= price * _count, "Ether sent with this transaction is not correct");and keeps the ETH in the contract. Non-owners are capped at 15 per transaction and needsaleOpen. - The owner can empty that balance at any time with
function withdraw() external onlyOwner { (bool success, ) = payable(msg.sender).call{value: address(this).balance}("");. Nothing in the contract escrows funds, refunds minters or ties withdrawals to delivery of the collection. - The owner also controls
changePrice,flipSaleandsetBaseURI, so the price, the sale switch and the metadata URL can all change after minting. The owner can mint without paying: the payment checks sit insideif (msg.sender != owner()).
**What happened**
- On 2022-03-23 at 05:36:49 UTC, 0x1C22C18F…943672 called
withdraw()on the contract and received 25.491 ETH (transaction 0x10ac9787…db7a07). - Later the same day, between 10:03 and 11:33 UTC, that address sent 7 ETH, 5.2 ETH and 7 ETH to 0x8E90793a…605573 and 0x193D681e…46d86F (transactions 0x59fd806a…db438d, 0x1654c33a…954c31 and 0x8dcce798…7746e0).
Protocol details
Evidence
- transaction Etherscan transaction 0x10ac978721758b63c2281c1f2c80c20a31340c542db7009a1363965d6edb7a07 etherscan.io
- transaction Etherscan transaction 0x59fd806aa044435f1c0979c16cb48762299c82c0a83a0e0e7bb4ebb086db438d etherscan.io
- transaction Etherscan transaction 0x1654c33a2efabd67e24dc080d7a516404e5a1e0555a009d9a59dfddf05954c31 etherscan.io
- transaction Etherscan transaction 0x8dcce79879ec713f51f3e4cb37d431a408fd488ff4ff8a211383375eea7746e0 etherscan.io
- address Doodle Monkey contract code (Etherscan) etherscan.io
- analysis Crypto Vigilante Telegram post 829 (De.Fi proof link) t.me
- analysis Doodle Monkey on Sourcify repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
