What happened
This is a fake Lifeform (LFT) token on Ethereum (contract 0x829d2578…120cC8) whose source header copies the real project's website and social links. A single privileged address stored as _taxData can credit itself a fixed, huge balance with removeLimits(), zero any holder's balance with delegate(), and flag addresses with addBots() so that every transfer they send reverts. On May 8, 2024 the deployer address 0xb57b3644…7638fe called removeLimits() (transaction 0x302727f3…aa7e1f, 07:32 UTC) and four minutes later sold about 1.603 quadrillion LFT through a Sushi route for 81.2 WETH (transaction 0x9c69a064…c18143, 07:36 UTC).
CertiK's alert of May 9, 2024 describes the call as a backdoor used to mint additional tokens and dump them on the pair, draining 81 ETH (about $243K); the DB figure is $250,000. De.Fi's database listing adds that the proceeds were then dispersed across different addresses.
How it happened
- Fake token: the contract reuses the real Lifeform name, website and social links in its header; the constructor sets
_tokename = "Lifeform",_taxData = addand mints 1,000,000,000 tokens to the deployer. - Hidden mint:
function removeLimits() external { if(_msgSender() == _taxData){ ... _balances[devWallet] += devAmount; } }withdevAmount = 10**decimals()*68800*(23300000000+300), i.e. 1,603,040,020,640,000 whole tokens, about 1.6 million times the 1e9 supply. The credit is not subtracted from anyone, emits no Transfer event and leaves_totalSupplyunchanged, and the function name suggests a harmless limit switch. It can be called repeatedly. When the caller is not_taxDatathe call does nothing and does not revert. - Sell block:
addBots(address bot)(only_taxData) setstokeninfo[bot] = true. In_transfer, a flagged sender getsamount = buyCount + _balances[from] + buyCount-buyCount;, which is the balance plus 64,544 raw units, so the next checkrequire(balance >= amount, ...)always reverts. A flagged holder cannot sell, and a flagged pair would block buys.delBotsreverses it. No source shows these were used. - Balance wipe:
delegate(address delegatee)(only_taxData) runs_balances[delegatee] *= sellCount;andsellCountis initialised to 0 and never changed, so any address balance becomes 0. - Giving up ownership does not remove these powers: all four functions check
_taxData, which has no setter, notowner(). The on-chainowner()read on 2026-09-30 is the zero address, yet_taxDatais unaffected. - What happened, per opened pages: on May 8, 2024 at 07:32:35 UTC 0xb57b...38fe called
removeLimits(); at 07:36:47 UTC the same address sent about 1.60304e15 LFT into a Uniswap V2 pool through the SushiSwap Route Processor and received 81.2032 WETH (about $220K at the explorer's conversion). CertiK describes this as a mint-and-dump that drained 81 ETH (about $243K).
Protocol details
Evidence
- report CertiK Alert tweet on fake Lifeform (LFT), 9 May 2024 twitter.com
- transaction Etherscan transaction 0x302727f3...a7e1f (removeLimits call) etherscan.io
- transaction Etherscan transaction 0x9c69a064...c18143 (LFT sold for WETH) etherscan.io
- address LFT.sol verified source (Etherscan, contract 0x829d2578aa1B013665e421ae894d055DA2120cC8) etherscan.io
- address etherscan.io address 0xb57b…38fe etherscan.io
- analysis Sourcify repository entry for the same contract repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
