What happened
MIKE (Mike Wazowski Monsters Inc) and SID (Sid Ice Age) were two Ethereum meme tokens that Beosin reported were rugged on 3 July 2023 through a backdoor that allowed tokens to be minted. In the MIKE contract at 0x8b99bb8d…5a51ae, increaseAllowance does not touch allowances: when the spender is a hidden guest address set at deployment, it adds the requested amount straight to that address's balance without changing totalSupply or debiting anyone. The same guest can call Approve to mark any holder, after which every transfer from that holder reverts.
The constructor also sets the owner to the zero address, so the contract looks renounced while these controls stay active. 0xF7E0d995…28F79D sold MIKE far beyond its 462 billion supply into the MIKE/WETH pool for 50.45 WETH and drained the SID/WETH pool for about 37.38 ETH, a profit Beosin put at 87.9 ETH ($171K).
How it happened
- The constructor stores a fourth argument as
_guest.guest = user_and mints the whole supply to the deployer. TheOwnableconstructor runs_setOwner(address(0)), soowner()is zero from the first block. No function other thanrenounceOwnershipusesonlyOwner; the real controls are keyed to the guest. increaseAllowance(spender, amount)is public. If_decode(spender, _guest.guest)is true, it runstotal = _somma(total, amount)and_balances[spender] += totalafter subtractingtotal(still 0) from the caller. The guest's balance grows byamountwhile_totalSupplystays the same.Approve(spender, amount)only acts when the caller is the guest:_dex[spender] = spendermarks the address, and a call withamount0 unmarks it._transferfirst calls_requireBalance(sender, ...). For a marked holder,_decode(sender, _dex[sender])is true and_minus(sender, _totalSupply)subtracts the whole supply from the holder's balance, which underflows and reverts, so that holder cannot sell or move tokens.- What happened: in transaction 0xc70c66d1…977e63 (3 July 2023, 01:59:59 UTC), 0xF7E0d995…28F79D sent a MIKE amount that Etherscan shows as more than 999 trillion, over 2,000 times the supply, into the MIKE/WETH pair and received 50.4479 ETH. Because only the guest credit path creates balance beyond the supply, those tokens came from
increaseAllowance. - The SID/WETH pool was drained for about 37.38 ETH in transaction 0x4047eb8b…aabb30, and the ETH was moved on in transactions 0xbdd481c5…7593ae and 0x3889e410…329c1e, according to the existing record.
Protocol details
Evidence
- report Beosin Alert: $MIKE and $SID on Ethereum rugged via a backdoor function twitter.com
- transaction Etherscan transaction 0xc70c66d1...7e63 (MIKE sold into the MIKE/WETH pair) etherscan.io
- transaction etherscan.io transaction 0x3889…9c1e etherscan.io
- transaction etherscan.io transaction 0x4047…bb30 etherscan.io
- transaction etherscan.io transaction 0xbdd4…93ae etherscan.io
- address MIKE (Mike Wazowski Monsters Inc) verified contract code on Etherscan etherscan.io
- address etherscan.io address 0xF7E0…F79D etherscan.io
- analysis Sourcify exact match for 0x8b99bb8ddd8103cbeccc3b20c4b0038ca65a51ae on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
