Kaonashi the Faceless Rug Pull
What happened
Kaonashi the Faceless (NOFACE) was an ERC20 token on Ethereum, contract 0x3eb4fc42…b1b4b3, deployed on 23 July 2023 with 111,111,111,111 NOFACE. Its owner() is set to the zero address in the constructor, so the token looks renounced from birth, but real control sits with a hidden address stored at deployment in _tokenInfo.addr. That address can freeze any holder: once it flags an address through a capitalised Approve function, every transfer from that address tries to subtract the whole total supply from its balance and reverts, so a flagged holder cannot sell.
A public addLiquidity function also credits any amount of NOFACE to the hidden address without changing the total supply. On 23 July 2023 Cyvers reported that the deployer removed 70 ETH (about $131,000) from the liquidity pool in transaction 0x900eda84…9dc20c and transferred it to 0x3fd9a477…edb492; the earlier write-up says the funds were then spread across four wallets.
How it happened
- The constructor records a hidden controller,
_tokenInfo.addr = token_;, mints the supply to the deployer, and leaves the owner as the zero address becauseOwnable's constructor calls_setOwner(address(0)). - The controller can flag any address: in
Approve,if (_crypten(user, _tokenInfo.addr))it sets_decenEx[spender] = spender;. - Every transfer first runs
_cheBala(sender, amount). For a flagged sender it setsamount = _totSup;and calls_timus(sender, amount), which computes_balances[account] - amount; this underflows and reverts for anyone holding less than the whole supply, so flagged holders cannot transfer or sell. - Anyone can call
addLiquidity(lpToken, amount); whenlpTokenequals the controller address,_balances[lpToken] += totalcredits itamountNOFACE without debiting anyone or changingtotalSupply, giving the controller unlimited tokens to sell. - Separately from these hidden powers, Cyvers reported that the deployer removed 70 ETH of liquidity from the Uniswap pool on 23 July 2023 and moved it to 0x3fd9a477…edb492. No source shows whether the freeze or hidden credit was also used.
Protocol details
Evidence
- report @CyversAlerts incident report twitter.com
- report Cyvers Alerts: deployer of $NOFACE removed 70 ETH from liquidity pool twitter.com
- transaction NOFACE token creation transaction etherscan.io
- transaction etherscan.io transaction 0x900e…c20c etherscan.io
- address Kaonashi the Faceless (NOFACE) verified source code etherscan.io
- address etherscan.io address 0x3129…4806 etherscan.io
- analysis Sourcify exact match for 0x3eb4fc424fab9100a64c87dc19602ed03cb1b4b3 on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.