Incident Overview
The contract deployer at:
https://etherscan.io/tx/0x77d8cbef…82f0ff
Tokens were unfairly distributed in huge amounts between different EOA addresses:
1. Recipient: 0x80f
https://etherscan.io/tx/0xf9822c73…c72dd0
2. Recipient: 0x57c
https://etherscan.io/tx/0x0b2a54b3…d70c3a
3. Recipient: 0x6b2
https://etherscan.io/tx/0xc453b1e1…6104ae
4. Recipient: 0x3a3
https://etherscan.io/tx/0xc71960c2…77d9d2
Between contracts:
1. Recipient: token sale contract
https://etherscan.io/tx/0xc71960c2…77d9d2
2. Recipient: vesting contract
https://etherscan.io/tx/0x56bede5d…ae7292
The contract deployer added liquidity at:
https://etherscan.io/tx/0xf6b2f700…f93b46
Token sale contract was used to distribute gathered ETH from the fundraising at:
https://etherscan.io/address/0xc6695f10…33d6a6#internaltx
ETH was transferred into 0xeaf EOA and the contract deployer's address.
The contract deployer added liquidity at:
https://etherscan.io/tx/0xf6b2f700…f93b46
0x80f sold tokens at:
https://etherscan.io/tx/0x7dad2876…245db4
0x57c sold tokens at:
https://etherscan.io/tx/0x71973719…5f2b96
0x6b2 transferred tokens to the other EOA address, which sold them at:
https://etherscan.io/tx/0x7240a1ea…a005ae
0x3a3 holds tokens on the address.
The final recipient of the stolen funds was the following address:
https://etherscan.io/address/0x839973ac…7056d7
Funds were deposited into Binance exchange wallet at:
https://etherscan.io/tx/0xcd09f05c…5a8ae8
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to Meta Pets, these are the critical security checks that could have prevented this incident (November 2021).
- Verify all logic paths related to Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialLearn to Prevent the Next Meta Pets
The Meta Pets hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.