Genswap Rug Pull

Reported loss $62K
Rugpull

What happened

GenSwap (GEN) is an ERC20 token on Ethereum with a Uniswap V2 pool against WETH. On 30 Aug 2023 CertiK Skynet reported an exploit of the token contract 0x65719eda…B631b7, saying the attacker abused an underflow to inflate their balance and then dumped the tokens. The transaction 0x61750911…9567c7, sent by 0xEB4BFb8e…85D144, swapped roughly 4.19 quadrillion GEN (total supply 10,000,000) for 38.36 ETH through Uniswap V2 Router 2. De.Fi's REKT database lists the loss as about 38 ETH (about 62,000 USD) and an exit scam, and lists two bridge deposits to Arbitrum, 0xfc3ddc44…6427be and 0x223e0e6a…d27a85.

The verified source shows where the underflow is: addresses on the fee-exempt list are routed to standardTransfer, which subtracts the amount from the sender's balance inside an unchecked block with no balance check. The sender address 0xEB4BFb8e... is hard-coded in the source as marketing_receiver and is set fee-exempt in the constructor.

How it happened

  1. The constructor sets marketing_receiver = 0xEB4BFb8e38f6658eA27d59F95B420C59cC85D144 and then isFeeExempt[marketing_receiver] = true;. The owner can add more exempt addresses with setisExempt or setInternalAddresses.
  2. _transfer handles an exempt sender first: if (isFeeExempt[sender]) {standardTransfer(sender, recipient, amount); return;}. This line comes before require(amount <= balanceOf(sender),"You are trying to transfer more than your balance");, so the balance check, the trading-allowed check and the max-tx limits are all skipped for exempt senders.
  3. standardTransfer runs unchecked {_balances[sender] = _balances[sender] - amount;} and _balances[recipient] = _balances[recipient] + amount;. Because the subtraction is unchecked, an exempt sender with a balance of 0 who sends amount ends up with a balance of 2^256 minus amount and the recipient is credited the full amount. Sending a very large amount to the Uniswap pair therefore credits the pool with tokens that were never in circulation.
  4. transferFrom calls _transfer(sender, recipient, amount) and then .sub(amount, "ERC20: transfer amount exceeds allowance") on the allowance, so the sender only needs an approve of at least that amount for the router; approve is open to anyone.
  5. What happened: Etherscan shows transaction 0x61750911…9567c7 from 0xEB4BFb8e…85D144 calling swapExactTokensForETHSupportingFeeOnTransferTokens on Uniswap V2 Router 2, sending about 4,192,296.86 billion GEN to the pool and receiving 38.36 ETH, at 2023-08-30 18:20:47 UTC. CertiK Skynet described the cause as an underflow that inflated the attacker's balance before the tokens were dumped.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract GEN
Protocol links @genswap_dex

Evidence

Same attack technique

Browse all hacks →
Boost Coin $593K lost EspressoBot $53K lost Symbiosis $24K lost Kizuna AI $135K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes