What happened
GN was an Ethereum rebasing token (contract NGMIGN) deployed on November 11, 2021 by 0xB0D56e32…7CaebE and paired with WETH on Uniswap V2. Its owner-only launch function, initializer, adds the contract's tokens and the caller's ETH to Uniswap and has the LP tokens minted to the owner's wallet instead of locking them, so if it was used, whoever held those LP tokens could withdraw that liquidity at any time. The contract also gave the owner a per-address block list and a function that credits token balances to any address; ownership has since been renounced.
On May 4, 2023, a transaction sent by 0xa7A5f0e2…9f4B8c removed 53.41 ETH and 210.88 billion GN of liquidity from the GN/WETH pair. De.Fi's listing names 0xa7A5f0e2…9f4B8c as the scammer address and values the removal at $96,097.
How it happened
- When called,
initializer()adds liquidity with the LP tokens sent to the owner:_router.addLiquidityETH { value: msg.value } (address(this), balanceOf(address(this)), 0, 0, owner(), block.timestamp);. Nothing in the contract locks or time-limits those LP tokens. - While ownership was held, the owner could block any address:
setPossibleBot(address account, bool trueOrFalse)sets_possibleBot[account], and every transfer runs_checkIfBot(sender); _checkIfBot(recipient);withrequire(_possibleBot[account] != true, "possible bot");, which stops that holder from sending or receiving. - The owner could also credit tokens to any address without a mint event:
disperseruns_fragmentBalances[lps[i]] += s * _frate;. Buy and sell fees are capped at 33% by_checkUnderLimit(). - Ownership is now renounced (the current owner is the zero address), so these owner functions no longer work. LP tokens already held in a wallet are not affected by renouncing.
- On May 4, 2023, a transaction sent by 0xa7A5f0e2…9f4B8c removed 53.41 ETH and 210.88 billion GN of liquidity from the Uniswap V2 GN pair (tx 0xa70fe18f…fde501). De.Fi's listing values it at $96,097.
Protocol details
Evidence
- transaction Etherscan transaction 0xa70fe18f...a8fde501 etherscan.io
- address NGMIGN (GN) verified contract source, Etherscan etherscan.io
- address etherscan.io address 0xB0D5…aebE etherscan.io
- address etherscan.io address 0xa7A5…4B8c etherscan.io
- analysis Sourcify exact match for 0xc5019e129b75d380d3d837b8e609dec6c8f5d044 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
