What happened
FutureBase.Finance (FBASE) is a token whose renounceOwnership() function does not give up ownership. The function is onlyOwner and adds 100,000,000 tokens to the caller's balance (_vOwned[_msgSender()] = _vOwned[_msgSender()].add(feetokens)), while _owner is left unchanged and _totalSupply is not increased. The initial supply was 100,000 tokens, so the owner could credit itself a balance one thousand times larger than everything that existed at launch.
Etherscan shows the deployer 0x854e48c1…06f7b0 added liquidity at 03:20 UTC on 2020-12-22 (100,000 FBASE and 50 ETH, tx 0xfd6d5756…f72712), called renounceOwnership() at 04:51 UTC (tx 0xdf787578…268902), and about a minute later swapped 100M FBASE for 56.7317 WETH through Uniswap V2 (tx 0x8cce4238…73c223). De.Fi's REKT database lists the incident as an exit scam / rug pull with 4,272 USD lost.
How it happened
- The deployer holds the whole initial supply:
initializesets_vOwned[_msgSender()] = initialSupplywithinitialSupply= 100000000000000 raw units (100,000 tokens at 9 decimals). - The contract defines its own
renounceOwnership():function renounceOwnership() public virtual onlyOwner { _vOwned[_msgSender()] = _vOwned[_msgSender()].add(feetokens); }, withfeetokens = 100000000 * 10 ** DECIMALS. The function body never writes_owner, so the owner stays in control, and it credits the caller 100,000,000 tokens without touching_totalSupply. - The deployer added 100,000 FBASE and 50 ETH to a Uniswap V2 pool at 03:20 UTC on 2020-12-22, which created the FBASE/WETH pool the later swap drew on.
- At 04:51 UTC the deployer called
renounceOwnership()(transaction succeeded). Under the code above this credits the caller's balance with 100,000,000 FBASE. - At 04:52 UTC the deployer sold 100M FBASE for 56.7317 WETH in a single
swapExactTokensForETHcall on Uniswap V2.
Protocol details
Evidence
- report @CaptainJackAPE incident report twitter.com
- transaction Etherscan transaction 0xdf78757847953d4fd56d1137ec451e4e86024c74c45afd9a067c3a1a6d268902 etherscan.io
- transaction Etherscan transaction 0x8cce4238c214ac20da5de73d673818f88c8ff7659b469bc0352cfcae6773c223 etherscan.io
- transaction Etherscan transaction 0xfd6d5756c49c0efd5c4e056a8416a523319540f92e994f6317a80debf6f72712 etherscan.io
- address FutureBase.Finance (FBASE) verified source on Etherscan etherscan.io
- analysis de.fi Analysis t.me
- analysis Sourcify exact match for 0x8a59500444d48041eb90f6fcbb5814a938d5a428 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
