What happened
FractalDefi.com (FRCTL) is a 9-decimal ERC-20 on Ethereum at 0x19BEB45E…50797B, deployed on 2020-12-17 with a 10,000,000 FRCTL supply. Etherscan shows the deployer 0xbbb5d974…beCC02 adding liquidity on 2020-12-17 (tx 0xeb074eb3…192f5a, 10 ETH with 9,000,000 FRCTL) and removing it on 2021-01-16 through Uniswap V2 Router 2 with removeLiquidityWithPermit (tx 0xc26213cc…b604da), receiving about 14.68 WETH. De.Fi's REKT database lists the incident as an exit scam with about $11.7k lost.
The token constructor credits the deployer with the whole supply except a reward-wallet amount, and the deployer is exempt from the per-transaction limit and from the trading lock that applies to pool and router traffic until the owner calls _enableTrading. The token has no mint function or blacklist, and liquidity removal itself happens on the pair with LP tokens, which the token code does not lock.
How it happened
- At construction, everything except the reward amount goes to the deployer:
_rOwned[_msgSender()] = reflectionFromToken(_tTotal.sub(_initialRewardLockAmount), false);. A source comment next to the constructor describes the reward amount as 10% of supply. - Trading is gated by an owner-only switch. In
_transfer, when neither side is the owner,if((_msgSender() == currentPoolAddress || _msgSender() == address(_uniswapV2Router)) && !tradingEnabled) require(false, "Trading is disabled.");blocks transfers made by the pool or the router.function _enableTrading() external onlyOwner() { tradingEnabled = true;sets it, and no function sets it back to false. The same condition,if(sender != owner() && recipient != owner() && !inSwapAndLiquify), exempts the owner from_maxTxAmount. - The code contains no lock on the deployer's liquidity position. Etherscan shows the deployer adding 10 ETH and 9,000,000 FRCTL to the pool on 2020-12-17 (tx 0xeb074eb3…192f5a).
- On 2021-01-16 20:10 UTC the deployer removed the liquidity through Uniswap V2 Router 2 with
removeLiquidityWithPermit(tx 0xc26213cc…b604da), receiving about 14.68 WETH and about 6.23 million FRCTL back, according to the Etherscan page.
Protocol details
Evidence
- report @CaptainJackAPE incident report twitter.com
- transaction Etherscan transaction 0xeb074eb3eeba066a858f2532ea134b1ccb4609cfdf493e73c6974058c6192f5a (addLiquidityETH) etherscan.io
- transaction Etherscan transaction 0xc26213cc0b760539cf991eb2ee137859b5256ae4068226e3586b61126db604da (removeLiquidityWithPermit) etherscan.io
- address Etherscan verified source for 0x19BEB45E21e0a2327E5bb33553fe6b58A650797B (FRACTAL.sol) etherscan.io
- analysis Web Archive web.archive.org
- analysis Sourcify match for chain 1 contract 0x19BEB45E21e0a2327E5bb33553fe6b58A650797B repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
