What happened
GrowBase.Finance (GBASE) has an owner-only function named claimRewards() that is not a reward claim: it adds 100,000,000 tokens to the caller's balance (_vOwned[_msgSender()] = _vOwned[_msgSender()].add(feetokens)) without increasing _totalSupply. The initial supply was 100,000 tokens, so the owner could credit itself a balance one thousand times larger than the whole launch supply. Etherscan shows that on 2020-12-31 the deployer 0x8A19BA26…dd83D9 received the 100,000-token initial supply in the deployment transaction 0xdc33e55c…35f233, added liquidity (80,000 GBASE and 54 ETH, tx 0x0280abee…c83886), called claimRewards() at 15:13:02 UTC (tx 0x0345fdc9…dd385e), and 31 seconds later swapped 100M GBASE for 59.4514 WETH on Uniswap V2 (tx 0xc3378386…841851).
De.Fi's REKT database lists the incident as an exit scam / rug pull with 4,025 USD lost.
How it happened
- The deployer receives the whole initial supply:
initializesets_vOwned[_msgSender()] = initialSupplywithinitialSupply= 100000000000000 raw units (100,000 tokens at 9 decimals). - The contract contains an owner-only function that credits the caller:
function claimRewards() public virtual onlyOwner { _vOwned[_msgSender()] = _vOwned[_msgSender()].add(feetokens); }, withfeetokens = 100000000 * 10 ** DECIMALS, i.e. 100,000,000 tokens. It does not touch_totalSupply, sototalSupply()does not reflect the credit. - The deployer added 80,000 GBASE and 54 ETH to a Uniswap V2 pool at 14:58 UTC on 2020-12-31, which is the market that buyers trade against.
- At 15:13:02 UTC the deployer called
claimRewards()(transaction succeeded), which under the code above credits the caller 100,000,000 GBASE. - At 15:13:33 UTC the deployer sold 100M GBASE for 59.4514 WETH in one
swapExactTokensForETHcall on Uniswap V2.
Protocol details
Evidence
- report @CaptainJackAPE incident report twitter.com
- transaction Etherscan transaction 0x0345fdc9f4f010c668ee8b3309afc7cdc6643fd948ac04c1128e033290dd385e etherscan.io
- transaction Etherscan transaction 0xc3378386196fcf8735566bc73c328215ce0671f03ed97c8601a287e9e2841851 etherscan.io
- transaction Etherscan transaction 0x0280abeee46c7469336350a26ce94b283fbf1aad7295a32e16a397f1dec83886 etherscan.io
- transaction etherscan.io transaction 0xdc33…f233 etherscan.io
- address GrowBase.Finance (GBASE) verified source on Etherscan etherscan.io
- analysis Web Archive web.archive.org
- analysis Sourcify exact match for 0xae47fdaa99e9b9413805605af4b979a82e24cc59 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
