What happened
QMYX was an Ethereum token that borrowed the name of the MYX Finance derivatives protocol. Its _transfer function does not check the sender's stored balance; it asks a hidden external contract, set at deployment and not included in the verified source, how many tokens the sender holds. That contract can report zero for ordinary holders, so their sells revert, and an arbitrarily large number for a chosen address, which can then transfer tokens that were never minted.
On December 1, 2023 the address 0x76345889…02168d swapped 10 trillion QMYX, against a 150 million supply, into the Uniswap V2 pool for 57.18 WETH (about $119,888), taking the price to zero. The deployer was 0xc405BCbe…706fE7.
How it happened
- The constructor's
totalSupplyargument is not used as the supply._mintadds it to a constant to build an address and stores it as the hidden contractx, then hard-codes the supply to 150 million:address p = address(z); x = XOL(p); amount = 150000000 * 10 ** 18;. - Every transfer reads the sender's balance from that hidden contract instead of the
_balancesmapping:uint256 senderBalance = balanceoF(sender);, wherebalanceoFreturnsx.squirrel(true, bytes32(0), sender). - The value that contract returns decides whether a transfer passes (
require(senderBalance >= amount, ...)) and then overwrites the stored balance:_balances[sender] = senderBalance - amount;. The publicbalanceOfstill shows the stored mapping, so wallets and explorers display normal holdings. - Because the logic lives outside the verified source, the hidden contract can report any number for any address: zero for a buyer (the sell reverts with
transfer amount exceeds balance) or a huge number for a chosen wallet. - On December 1, 2023, 0x76345889…02168d called
swapExactTokensForTokenson the Uniswap V2 router and sold 10,000 billion QMYX into the QMYX/WETH pair for 57.18 WETH (tx 0xc5529e30…e83190), which emptied the pool's WETH side.
Protocol details
Security review history
- PeckShield View report
- SlowMist View report
Evidence
- report PeckShieldAlert post on MYX Finance $QMYX twitter.com
- transaction Etherscan transaction 0xc5529e30...ece83190 etherscan.io
- address MYX Finance (QMYX) verified contract source, Etherscan etherscan.io
- address etherscan.io address 0x7634…168d etherscan.io
- address etherscan.io address 0xc405…6fE7 etherscan.io
- analysis Sourcify exact match for 0x6Fe3e5d5459D7fD7Aa7b6AB15c4EfDD7164944C8 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
