F*ck The Merge Rug Pull

Reported loss $110K
Rugpull

What happened

Fuck The Merge (FUCKMERGE) was an Ethereum token traded on Uniswap V2, deployed on September 15, 2022, the day of the Ethereum Merge. Its contract gives a hard-coded owner, the deployer 0x0c41D309…4AC32e, an unlimited _mint function, functions that burn or move any holder's entire balance, and a function that emits fake Transfer events from the Uniswap pool; there is no working way to renounce these powers. According to De.Fi's listing, the deployer created the F*CKMERGE/WETH pair 0x76aaaa34…623814 with 100 WETH of initial liquidity and, after users bought the token, drained the remaining 178 WETH.

On-chain, the deployer sold FUCKMERGE through the Uniswap V2 router in three swaps that same day (0x364ad812…062815, 0xb7da9882…cd9c22 and 0xf27aa3a0…132342) that returned about 175 ETH in total. The tokens sold far exceeded the 1 trillion minted at deployment. De.Fi's listing puts the deployer's profit at $110,383.

How it happened

  1. The owner is a hard-coded address with no setter: address public _owner = 0x0c41D309E970b4F4Dc368Af5072c0251494AC32e;. The renounceOwnership function sits inside a comment block and is not compiled.
  2. _mint is public and gated only by require(msg.sender == _owner, ...). It adds any amount to the owner's balance, _balances[_owner] = _balances[_owner].add(amount);, while the event names a different account, so the owner can create unlimited tokens.
  3. bridge(address account) burns a holder's entire balance and stake(address account, address staker) moves a holder's entire balance to any address, both owner-only. tokenDropDirect emits Transfer events from a chosen pool address without moving any balances, which can make fake buys appear in explorers and trackers.
  4. The _positiveReceiver and _negativeReceiver lists set by approvalIncrease and addApprove are never read, because the odds modifier on transfers is empty (_;). Holders could sell normally; the trap was the owner's supply and balance powers.
  5. On September 15, 2022 the deployer sold 508.67 billion, 4,142.98 billion and 119,595.91 billion FUCKMERGE through the Uniswap V2 router for 80.8, 79.65 and 15 ETH (tx 0x364ad812…062815, 0xb7da9882…cd9c22 and 0xf27aa3a0…132342). These amounts exceed the 1 trillion constructor supply, and _mint is the only function that raises _totalSupply; the contract's current total supply is about 10^36 tokens.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract F*CKMERGE

Evidence

Same attack technique

Browse all hacks →
Hunter Doge $46K lost TSUKA $71K lost Cornerchain $51K lost Meta Magic Coin $62K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes