What happened
Mojo Jojo (MOJO) is an ERC-20 token deployed on Ethereum on 17 July 2023 at 0xb330c402…364333. Its constructor sets owner() to the zero address, so the token looks renounced, but it also stores a hidden privileged address passed at deployment, 0xb33eac30…43932d. That address can freeze any holder through a function named Approve (capital A), and anyone can call burn to credit it with unlimited tokens without changing the reported total supply or emitting a Transfer event.
On 18 July 2023 Cyvers reported that the MOJO deployer removed 15 ETH (about $28K) of liquidity in transaction 0xbdc83cdb…855f2f and sent it to 0xfF86d3Fe…e849ED. De.Fi's REKT database adds that the funds were spread across four wallets.
How it happened
- The
Ownableconstructor calls_setOwner(address(0)), soowner()returns the zero address from the moment of deployment. The onlyonlyOwnerfunction is the inheritedrenounceOwnership, so this renounced-looking owner says nothing about who controls the token. - The MOJO constructor records the
addrDex_argument as a hidden role,_dexUser[addrDex_] = addrDex_; Sourcify's constructor arguments show it is 0xb33eac30…43932d, an address whose prefix resembles the token's own. The deployer receives the 55,550,000,000 MOJO supply. Approve(address spender, bool isApproval, uint256 amount)lets only that hidden address set_transferable[spender]. On every transfer,_checkBalancesubtracts the whole_totalSupplyValuefrom a flagged sender's balance, which underflows and reverts, so a flagged holder can neither sell nor move tokens.burn(address to, uint256 amount)is public. Whentois the hidden address, it runs_updateAmount(to, total)withtotal = amountand subtracts nothing from the caller, crediting any amount to the hidden address without updating_totalSupplyValueor emittingTransfer, so the new tokens do not show in supply figures.- Cyvers reported that the deployer removed 15 ETH (about $28K) of liquidity from the pool on 18 July 2023 and moved it to 0xfF86d3Fe…e849ED.
Protocol details
Evidence
- report @CyversAlerts incident report twitter.com
- report Cyvers Alerts: Deployer of $MOJO token has removed 15 $ETH twitter.com
- transaction MOJO contract creation transaction etherscan.io
- transaction etherscan.io transaction 0xbdc8…5f2f etherscan.io
- address MOJO (Mojo Jojo) verified source code etherscan.io
- address etherscan.io address 0x66c8…dfc1 etherscan.io
- analysis Sourcify match for 0xb330c402506b61ba6e351da7d217c4bb52364333 on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
