What happened
MANTLE is a reflection token with no mint function and an initial supply of 5,000 MANTLE (_tTotal = 5000 * 10**9), all assigned to the deployer in the constructor. Every transfer carries a 2% reflection fee (_taxFee, which the owner can set between 1 and 10) and a fixed 2% burn, and non-owner transfers are capped at 500 MANTLE (_maxTxAmount = 500e9), a cap the owner can only raise. The contract has no blacklist, trading switch or sell block.
Etherscan shows the deployer wallet 0x816881A2…59b05e adding initial liquidity of 4,512 MANTLE and 4.5 WETH in 0x0ed98554…025272 and receiving 0.004549794 UNI-V2 LP tokens, which it locked in a Rainicorn vesting contract in 0xba8d2f0f…06c38c. On 2021-03-21 the same wallet called withdrawTokens on that contract in 0x97497bce…b03e64 and received the 0.004549794 LP tokens back. De.Fi's REKT database lists that the deployer then removed liquidity multiple times (listed link: Source, not opened) and lists the loss at 9,507 USD.
How it happened
- The constructor assigns the whole supply to the deployer:
_rOwned[_msgSender()] = _rTotal;with_tTotal = 5000 * 10**9. - On 2020-12-21 the deployer wallet called
addLiquidityETHin 0x0ed98554…025272, depositing 4,512 MANTLE (about 90% of the initial supply) and 4.5 WETH and receiving 0.004549794 UNI-V2 LP tokens. - The same day the wallet locked those LP tokens in the Rainicorn vesting contract 0xDBF72370…c6220A with
lockTokensin 0xba8d2f0f…06c38c. - On 2021-03-21 the wallet called
withdrawTokens(uint256 _id)on that contract in 0x97497bce…b03e64 and the 0.004549794 LP tokens moved back to it, so the pool liquidity was again controlled by the deployer. - De.Fi's REKT database lists that liquidity was then removed multiple times by the deployer; those removal transactions were not opened.
Protocol details
Evidence
- report @WARONRUGS incident report twitter.com
- report MANTLE source (Sourcify, chain 1) repo.sourcify.dev
- transaction Etherscan transaction 0x0ed98554...025272 (addLiquidityETH) etherscan.io
- transaction Etherscan transaction 0xba8d2f0f...6c38c (lockTokens) etherscan.io
- transaction Etherscan transaction 0x97497bce...3b03e64 (withdrawTokens) etherscan.io
- address MANTLE verified source (Etherscan) etherscan.io
- analysis bloxy.info page 0x8168…b05e bloxy.info
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
