What happened
GUIDO The Mechanics (GUIDO) is an ERC-20 token deployed on Ethereum on 17 June 2023 at 0x7907c517…1b9146, with 6.9 trillion tokens minted to the deployer 0x5A39b896…BB64fe. Its constructor sets owner() to the zero address, so it looks renounced, but it also stores a hidden privileged address, 0xF6B87e61…Bff8BA. That address can freeze any holder through a function named Approve (capital A), and anyone can call IncreaseAllowance (capital I) to credit it with unlimited tokens without changing total supply or emitting a Transfer event.
At 15:35 UTC the same day, the hidden address sold more than 999 trillion GUIDO, far above the 6.9 trillion total supply, into the Uniswap V2 pool for about 27.98 WETH in transaction 0x8c444527…1946e5. De.Fi's REKT database records the loss as about 36 ETH ($62,695) taken by an address linked to the deployer and moved across several addresses, citing transaction 0x08a9c31d…2f8ee5, while De.Fi's alert of 19 June put the total at 63 ETH removed from the pool (about $108,000).
How it happened
- The
Ownableconstructor calls_setOwner(address(0)), soowner()returns the zero address from deployment. The onlyonlyOwnerfunction isrenounceOwnership, so the zero owner says nothing about who controls the token. - The
Guidoconstructor stores thedex_argument as a hidden role,_dex[dex_] = dex_. Sourcify's constructor arguments show it is 0xF6B87e61…Bff8BA. The deployer receives the full 6,900,000,000,000 GUIDO supply. Approve(address spender, bool isApproval, uint256 amount)lets only that hidden address set_canTransfer[spender]. On every transfer,_requireBalancesubtracts the whole_totalSupplyfrom a flagged sender's balance, which underflows and reverts under Solidity 0.8.4, so a flagged holder cannot sell or move tokens.IncreaseAllowance(address recipients, uint256 amount, bool isApproved)is public. Whenrecipientsis the hidden address, it subtractstotalwhiletotalis still 0, then addsamount, so any caller can credit any amount to the hidden address._totalSupplyis not updated and noTransferevent is emitted.- In transaction 0x8c444527…1946e5 (block 17500455), the hidden address sent more than 999 trillion GUIDO to the Uniswap V2 GUIDO pool through a swap router and received about 27.98 WETH. A balance that large exceeds the total supply, which only the step 4 credit path can produce.
Protocol details
Evidence
- report @DeDotFiSecurity incident report twitter.com
- report De.Fi Antivirus Web3: ~$108,000 $GUIDO RUG PULL twitter.com
- transaction GUIDO contract creation transaction etherscan.io
- transaction GUIDO pool drain transaction 0x8c444527...1946e5 etherscan.io
- transaction etherscan.io transaction 0x08a9…8ee5 etherscan.io
- address Guido (GUIDO The Mechanics) verified source code etherscan.io
- address etherscan.io address 0x5A39…64fe etherscan.io
- address etherscan.io address 0xF6B8…f8BA etherscan.io
- analysis Sourcify match for 0x7907c5172ed24eb569f0c45141ce4e27851b9146 on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
