What happened
This "Friend Tech" (FT) token was an Ethereum ERC-20 that borrowed the name and links of the friend.tech social app but was not connected to it. Its hard-coded owner, 0x8522a110…33cCeD, can mint unlimited tokens to itself, and a second hard-coded address can set any holder's balance to zero. The contract also rewrites its own Transfer events so the owner's transfers appear to come from another address, and its renounceOwnership and lock functions do nothing.
The deployer added 100 ETH of liquidity on Uniswap V2 on 18 August 2023 and removed it on 19 August 2023 for 235.17 ETH, a gain of about 135 ETH (about 226,000 USD). CertiK flagged it as a large liquidity removal on a fake Friend Tech token.
How it happened
- The owner is a constant, not a transferable role:
address public _Owner = 0x8522a1106B0e26584AF2658bd099005FDC33cCeD;.renounceOwnership()andlock()have empty bodies, so calling them changes nothing. removeLimits(address locker, uint256 amt)only requiresmsg.sender == _Ownerand then runs_totalSupply = _totalSupply.add(amt);and_balances[_Owner] = _balances[_Owner].add(amt);. Despite its name it is an unlimited mint to the owner, and it emits the mint event tolockerrather than to the owner. The constructor uses it four times to create 1.1 billion FT.Approve(address[] memory recipients)is restricted to 0x9bfA2DD3…F77C3B and moves each listed address's whole balance toaddress(0)without emitting aTransferevent, so that address can wipe out any holder's tokens._transferreplaces the owner's address in the emitted event:if (sender == _Owner){sender = team_addr;}. In the liquidity-add transaction Etherscan shows the 933.2 million FT coming from an address it labels "KosettoWearables Deployer" instead of the owner.- On 18 August 2023 at 21:21 UTC the deployer added 100 ETH and about 933.2 million FT to a new Uniswap V2 pool with
addLiquidityETHand received the LP tokens. - On 19 August 2023 at 15:00 UTC the deployer called
removeLiquidityETHWithPermitand withdrew 235.17 ETH and about 398.2 million FT from the pool. The 135 ETH difference had been paid in by buyers.
Protocol details
Post-Incident Timeline
-
2023-08-29
On August 29, 2023, the project was rugpulled on the Base chain for an additional 134 ETH. The stolen funds were distributed between multiple EOA addresses. Scammer Addresses: Address 0xda23…3bcb Address 0x8281…500a Funds Draining Transaction: Tx 0x87ae…f1fd
Evidence
- report CertiK Alert on the fake Friend Tech token liquidity removal twitter.com
- report @AnciliaInc incident report twitter.com
- transaction FT liquidity removal transaction etherscan.io
- transaction FT liquidity add transaction etherscan.io
- transaction etherscan.io transaction 0x32e8…2127 etherscan.io
- transaction etherscan.io transaction 0xec1b…b954 etherscan.io
- address FriendTech (FT) verified source code etherscan.io
- address etherscan.io address 0x0d54…34b8 etherscan.io
- address etherscan.io address 0x5b33…d7c6 etherscan.io
- address etherscan.io address 0x67f6…eaFf etherscan.io
- address etherscan.io address 0x8522…cCeD etherscan.io
- address etherscan.io address 0xe6c4…0a7c etherscan.io
- analysis Sourcify match for 0x2cf82a3ad32aa580110278022a6493b631044bef on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
