What happened
Majin Buu (BUU) was an Ethereum meme token at 0xF746d527…fB7C5e, deployed on 31 July 2023 by 0x690F2Be8…91132D. Its code gives a hidden address, set at deployment, two backdoors: anyone calling increaseAllowance with that address as spender adds the amount straight to its balance without changing totalSupply, and that address can call Approve to mark any holder so every transfer from them reverts. The constructor sets the owner to the zero address, so the contract looks renounced while these controls stay active.
The loss itself came from liquidity. De.Fi's REKT database says the deployer added 38 ETH to the pool on 31 July, and on 1 August 2023 the deployer withdrew its Uniswap V3 position, taking 129.87 ETH and 31.7 billion BUU. De.Fi's listing puts the loss at $168,213 and says the funds went first to 0x6d99a6ac…67666f and were then split across several other addresses; De.Fi's alert gave about $237K for the 129 ETH and reported 55 ETH sent to Tornado Cash. The listing also notes the project website had been shut down.
How it happened
- The constructor stores its third argument as
_array[0].addrand mints the whole supply to the deployer. TheOwnableconstructor runs_setOwner(address(0)), soowner()is zero from the first block. increaseAllowance(spender, allowAmount)is public. If_hashe(spender, _array[0].addr)is true, it runsamount = _calc(amount, allowAmount)and_balances[spender] += amountafter subtractingamount(still 0) from the caller. The hidden address's balance grows while_totalSupstays the same.Approve(spender, amount)acts only when the caller is that hidden address:_dex[_spender] = _spendermarks the target, and a call withamount0 unmarks it._transferfirst calls_requireBalance(sender, ...). For a marked holder,_hashe(_from, _dex[_from])is true and_desc(_from, _totalSup)subtracts the whole supply from the holder's balance, which underflows and reverts, so that holder cannot sell or move tokens.- What happened: in transaction 0xba394684…becf52 (1 August 2023, 04:25:59 UTC), the deployer called
multicallon the Uniswap V3 Positions NFT contract and withdrew 129.873 WETH, unwrapped to ETH, and about 31.7 billion BUU from the pool 0xdF1A71C8…ab1AEC. - According to De.Fi's listing, the funds were then moved to 0x6d99a6ac…67666f and on to several other addresses; De.Fi's alert reported 55 ETH going into Tornado Cash.
Protocol details
Evidence
- report De.Fi Antivirus Web3: Looks like @MajinBuuuDB Rugged twitter.com
- transaction Etherscan transaction 0xba394684...cf52 (Uniswap V3 position withdrawal) etherscan.io
- address MAJIN BUU (BUU) verified contract code on Etherscan etherscan.io
- address etherscan.io address 0x690F…132D etherscan.io
- address etherscan.io address 0x6d99…666f etherscan.io
- analysis Web Archive archive.ph
- analysis Sourcify exact match for 0xF746d527336E299ce53E2Ed337c2668d6CfB7C5e on Ethereum repo.sourcify.dev
- analysis De.Fi REKT database entry for BUU (write-up with block data references) de.fi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
