Hatch DAO Rug Pull

Reported loss Not disclosed
Ethereum
Rugpull

What happened

HatchDAO (HATCH) is an Ethereum token deployed on 17 September 2020 at 0x6f300966…495fcb with 520,000 HATCH minted to the deployer, 0x199A2C0b…1a04ce. Its MintTokens function lets whichever address the owner sets as incubator mint new HATCH to any address, up to a 10,000,000 cap, and nothing stops the owner from making itself the incubator. The deployer added 45,000 HATCH and 225 ETH as the first Uniswap V2 liquidity on 18 September 2020 (tx 0x485f0a47…931dce).

On 25 September 2020 it called MintTokens to mint 2,000,000 HATCH to its own wallet (tx 0x33c247ca…d3fa1d) and about three minutes later sold them into the pool for 239.997 ETH (tx 0xa67b7092…249d15), more ETH than the 225 ETH it had deposited as liquidity. De.Fi's REKT database lists HatchDAO as an exit scam/rug pull and notes that the liquidity later removed was not much larger than the initial deposit, so losses cannot be calculated precisely; a HackerNoon list of 2020 exit scams puts the project's token-sale raise at about $760,000.

How it happened

  1. The constructor credits 520,000 HATCH to owner, the deployer. maxCapSupply is 10,000,000 HATCH.
  2. SetIncubator(address) is onlyOwner and accepts any non-zero address, so the owner can name itself the incubator.
  3. MintTokens(_amount, _beneficiary) only checks msg.sender == incubator and the cap, then adds _amount to _beneficiary's balance.
  4. On 18 September 2020 the deployer called the Uniswap V2 router's addLiquidityETH with 45,000 HATCH and 225 ETH and received the pool's LP tokens.
  5. On 25 September 2020 the deployer called MintTokens directly and received 2,000,000 new HATCH. The call could only succeed if the deployer was the incubator at that point.
  6. About three minutes later the deployer sold the 2,000,000 HATCH through swapExactTokensForETH and received 239.997 ETH from the pool, taking that ETH out of the pool that pays other holders when they sell.

Protocol details

Classification Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract HATCH
Protocol links Website @HatchDAO

Evidence

Same attack technique

Browse all hacks →
Ethereum Unidark $30K lost Ethereum Vegetables Finance $3K lost Ethereum LV Finance $334K lost Eth Contingency $25.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes