Kaonashi the Faceless Rug Pull

Reported loss $131K
Rugpull

What happened

Kaonashi the Faceless (NOFACE) was an ERC20 token on Ethereum, contract 0x3eb4fc42…b1b4b3, deployed on 23 July 2023 with 111,111,111,111 NOFACE. Its owner() is set to the zero address in the constructor, so the token looks renounced from birth, but real control sits with a hidden address stored at deployment in _tokenInfo.addr. That address can freeze any holder: once it flags an address through a capitalised Approve function, every transfer from that address tries to subtract the whole total supply from its balance and reverts, so a flagged holder cannot sell.

A public addLiquidity function also credits any amount of NOFACE to the hidden address without changing the total supply. On 23 July 2023 Cyvers reported that the deployer removed 70 ETH (about $131,000) from the liquidity pool in transaction 0x900eda84…9dc20c and transferred it to 0x3fd9a477…edb492; the earlier write-up says the funds were then spread across four wallets.

How it happened

  1. The constructor records a hidden controller, _tokenInfo.addr = token_;, mints the supply to the deployer, and leaves the owner as the zero address because Ownable's constructor calls _setOwner(address(0)).
  2. The controller can flag any address: in Approve, if (_crypten(user, _tokenInfo.addr)) it sets _decenEx[spender] = spender;.
  3. Every transfer first runs _cheBala(sender, amount). For a flagged sender it sets amount = _totSup; and calls _timus(sender, amount), which computes _balances[account] - amount; this underflows and reverts for anyone holding less than the whole supply, so flagged holders cannot transfer or sell.
  4. Anyone can call addLiquidity(lpToken, amount); when lpToken equals the controller address, _balances[lpToken] += total credits it amount NOFACE without debiting anyone or changing totalSupply, giving the controller unlimited tokens to sell.
  5. Separately from these hidden powers, Cyvers reported that the deployer removed 70 ETH of liquidity from the Uniswap pool on 23 July 2023 and moved it to 0x3fd9a477…edb492. No source shows whether the freeze or hidden credit was also used.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract NOFACE

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.