Gladiator Rug Pull

Reported loss $246K
Rugpull

What happened

Gladiator (GLA) is an Ethereum token at 0xe9c28e4f…696d47, deployed on 11 August 2023 by 0xfD98A561…B2F5fE, which received all 14,666,000,000 GLA. Its Ownable constructor sets the owner to the zero address, so the token looks renounced from the first block, but a hidden control does not depend on the owner: a king_ address fixed at deployment can call a function named Approve (capital A) to give any address a threshold, and every transfer from that address must then be larger than the threshold. Set at or above a wallet's balance, the threshold blocks that wallet from selling; set on the pool, it blocks every buy.

The loss itself came from the liquidity: on 14 August 2023 the deployer withdrew its Uniswap V3 position, taking 132.92 WETH and about 5.21 billion GLA out of the pool in transaction 0x8cee548d…9eda87. De.Fi's Artem reported the deployer removed about 139.2 ETH ($257K) from a pool first supplied with 38 ETH, and the existing record lists 0xa88a470f…4a5032 as the funds holder as of that day.

How it happened

  1. The constructor mints the whole supply to the deployer and stores _leonidas.push(Shield(king_, 300)), fixing a hidden privileged address. Ownable's constructor runs _setOwner(address(0)), so owner() returns zero from deployment.
  2. Approve(address account, uint256 amount) is public. When the caller is _leonidas[0].cross (the king_), _warrior sets _sparta[account].spear = total with total equal to amount; for any other caller it adds zero and changes nothing. It emits an ordinary-looking Approval event.
  3. Every transfer runs require(amount - roman(sender) > 0, "roman"), where roman returns the sender's spear. With Solidity 0.8 checked arithmetic, an amount below the threshold reverts on underflow, an equal amount fails the check, and only larger amounts pass.
  4. A threshold at or above a holder's balance therefore blocks that holder's every transfer, including sales, since the pool pulls tokens from the seller. A threshold on the pool address makes the pool's transfers to buyers fail.
  5. What happened: in transaction 0x8cee548d…9eda87 (14 August 2023, 02:14:47 UTC) the deployer called multicall on the Uniswap V3 Positions NFT contract and received 132.92 WETH, unwrapped to ETH, and about 5.21 billion GLA from the pool.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract GLA

Evidence

Same attack technique

Browse all hacks →
Snake Eyes $117K lost Jigsaw saw you $160K lost Coin $42K lost Plankton Plankton $288K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes