What happened
MORTAL KOMBAT (MK) is a BNB Chain token deployed on 6 May 2021 at 0x26a1c344…d5e91d by 0x271a36B0…c7ce44, which is still its owner. Next to the normal transfer, the contract has an owner-only transferOwner that moves tokens with unchecked arithmetic. The contract is compiled with Solidity 0.5.16, which does not revert on underflow, so the owner can send any amount, even more than they hold, and the recipient is credited in full.
This works as a hidden, unlimited mint: totalSupply still reports 1,500,000 MK while the owner can create tokens to sell into the market. De.Fi's REKT database lists MK as an exit scam; no transaction showing transferOwner being used was found.
How it happened
- The constructor mints the full 1,500,000 MK (9 decimals) to the deployer and there is no public
mintfunction, so the supply looks fixed. transferOwner(address recipient, uint256 amount)isonlyOwnerand calls_transferOwner, which updates balances with plain operators:_balances[sender] -= amount;and_balances[recipient] += amount;. The normal_transferusesSafeMath.suband would revert on an insufficient balance; this path does not.- Under Solidity 0.5.16, if
amountexceeds the owner's balance, the subtraction wraps around to a number close to 2^256 instead of failing. The recipient gets the fullamount, and the owner is left with an effectively unlimited balance. _totalSupplyis never updated, sototalSupply()keeps showing 1,500,000 MK and explorers show no mint event, only aTransferfrom the owner.- With that balance the owner can sell MK into any liquidity pool for its paired asset.
renounceOwnershipexists, but the owner is still the deployer, so the function remains available.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
