Groot.finance Rug Pull

Reported loss $4K
Ethereum
Rugpull

What happened

GROOT.FINANCE (GRT) is an ERC-20 token on Ethereum at 0x81726558…92cd4a. Its owner has two powers a standard token does not have. addPhase credits any amount of GRT to any address without raising the reported total supply, and addPower flags addresses so that every transfer they send reverts.

On 2 November 2020 the deployer, 0xba5aee90…5Ace95, paired the whole 80,000 GRT supply with 30 ETH on Uniswap V2. About four and a half hours later it called addPhase to credit itself 500,000,000 GRT, and one minute after that it sold those tokens through the Uniswap V2 router for 40.58 ETH. The totalSupply still reads 80,000 GRT today, because the hidden mint never updated it.

De.Fi's REKT database lists the loss as $4,049.

How it happened

  1. The GROOT constructor mints the supply once through the standard _mint, which increases _totalSupply. The token's ERC20 base also inherits Ownable, and the deployer is the owner.
  2. addPhase(address account, uint256 amount) public onlyOwner calls _phase, which runs _balances[account] = _balances[account].add(amount) and emits a Transfer from the zero address, but never touches _totalSupply. The owner can credit any amount, and supply-based checks still show the original 80,000 GRT.
  3. addPower(address[] memory account) public onlyOwner sets power[account[i]] = true, and _transfer starts with require(!power[sender], "error"). The owner can block any holder from selling or moving tokens. No transaction was reviewed showing this was used.
  4. On 2 November 2020 at 01:45:45 UTC the deployer added the whole 80,000 GRT supply and 30 ETH as Uniswap V2 liquidity in transaction 0x6c9e22b6…860390.
  5. At 06:14:06 UTC the deployer called addPhase for its own address with 500,000,000 GRT in transaction 0x0625c4ab…82c8f4.
  6. At 06:15:26 UTC it sold those 500,000,000 GRT with swapExactTokensForETH for 40.58 ETH in transaction 0xa669e7e6…ab2c70. The sale took more ETH out of the pool than the deployer's own 30 ETH, so the difference came from buyers.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract GRT
Protocol links Website @grootfinance

Evidence

Same attack technique

Browse all hacks →
Ethereum Bloody Finance $1K lost Ethereum Keep3rX.finance $2K lost Ethereum Kper Network $542K lost Ethereum SuperMarioBros $10K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes