What happened
This "Mina Protocol" (MINA) token is a BEP-20 copy on BNB Chain at 0xDC2cE292…55bc39 that borrows the name of the unrelated Mina Protocol blockchain; it was deployed on 24 October 2023 by 0x1EC5a461…76f7F6. Its verified source hides a balance override: before every transfer, _transfer replaces the sender's balance with a number returned by an external contract whose address was passed in at deployment and never shown in the code. That contract can set any wallet's balance to zero, so sells revert, or give a chosen wallet more tokens than the 1,000,000,000 total supply.
Ownership was renounced (the on-chain owner is the zero address), but the override is not an owner function, so renouncing did not remove it. On 25 October 2023 PeckShield reported that 0x0920baB9…2da44A swapped 1,000,000,000,000,000 MINA for about 474.26 BNB (about $107.5K), taking the price to zero; the record lists the loss as $106,395 (474.25 WBNB), with the proceeds routed through several addresses to Binance.
How it happened
- At deployment the constructor takes
a8cik10and stores it as an address:IWFIpAVOYnOUOnOIEopbM = (address(uint160(a8cik10)));. The contract at that address is not part of the verified source. - Every
transferandtransferFromruns_transfer, which first overwrites the sender's balance with that contract's answer:_balance[xlzsakutfrom] = _4b5600ccc(xlzsakutfrom, amount, _balance[xlzsakutfrom]);. - If the hidden contract returns less than the amount for a holder, the next line,
require(_balance[xlzsakutfrom] >= amount, ...), reverts, so that holder cannot sell into the pool. - If it returns a huge number for a chosen wallet, that wallet can transfer far more than
_totalSupply(fixed at1000000000 * 10**_decimals) without any mint call orTransferevent from the zero address. - PeckShield reported that 0x0920baB9…2da44A sold 1,000,000,000,000,000 MINA, a quantity a million times the stated supply, for about 474.26 BNB, emptying the PancakeSwap pool.
Protocol details
Evidence
- report PeckShieldAlert: Mina Protocol $MINA on BNB Chain has dropped -100% twitter.com
- transaction Mina Protocol contract creation transaction bscscan.com
- transaction bscscan.com transaction 0x47d2…52cb bscscan.com
- transaction bscscan.com transaction 0xb799…1abd bscscan.com
- address TOKEN (Mina Protocol) verified source code bscscan.com
- address bscscan.com address 0x0920…a44A bscscan.com
- address bscscan.com address 0x1EC5…f7F6 bscscan.com
- analysis Sourcify match for 0xDC2cE29256a7F44C3A291f8C08D575593455bc39 on BNB Chain repo.sourcify.dev
- analysis bscscan page bscscan bscscan
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
