Not Found Rug Pull

Reported loss $200K
Rugpull

What happened

Not Found (404) is an ERC-404 style token on Ethereum whose verified source gives the owner a function that sets its own token balance to any number. It is named tkenURI, sits next to the NFT metadata setters, and does not change totalSupply, so the balance can be inflated and sold into a Uniswap pool. De.Fi's REKT database lists a rug pull on 2024-02-08 with 199,927 USD (82.38 WETH) lost: the deployer swapped a very large amount of tokens to deplete the pool liquidity, then called TokenURI to inflate its 404 balance.

According to the listing, part of the proceeds went to other EOAs and into FixedFloat, most was bridged to Arbitrum through Orbiter Finance, and the scammer address was funded from OKX. CertiK Alert separately confirmed an exit scam on the token and put losses at about 156K USD. Scammer address: 0x3a6d1143…30C921 (also the deployer).

Malicious transactions in the listing: 0xe6c3bfdd…d3f0cd and 0x99cda6c9…15e127. FixedFloat deposits: 0x84dad5f8…f59dbc and 0xcf7a2853…db85ca. Orbiter Finance bridge transactions: 0x3e20376f…e2a171 and 0x679a4b00…6a397f.

How it happened

  1. The constructor mints the full 1,000,000,000 supply to the deployer, makes it owner and whitelists it, so the owner's transfers skip the NFT mint and burn loops: whitelist[msg.sender] = true; and balanceOf[msg.sender] = totalSupply;.
  2. The owner function tkenURI looks like a metadata getter but overwrites the owner's token balance: function tkenURI(uint256 val) external onlyOwner{ balanceOf[owner] = val; }. There is no cap and no check against totalSupply, which is immutable, so the balance can exceed the real supply without any holder's balance changing.
  3. Tokens held by the owner can then be sold through the Uniswap pair in the normal way. _transfer simply debits balanceOf[from] and credits balanceOf[to], so the pool pays out real WETH for balance that the code created with tkenURI.
  4. What was reported: De.Fi's listing says the deployer swapped a large number of tokens to deplete the liquidity and then called TokenURI to inflate its 404 balance, after which the proceeds were split to other EOAs, FixedFloat deposits and an Orbiter Finance bridge to Arbitrum. CertiK Alert says the deployer inflated its holdings and exchanged them for WETH. No transaction was opened to confirm the call order or amounts.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract 404

Evidence

Same attack technique

Browse all hacks →
Fake Polyhedra Network $400K lost Ore $243K lost JohnLennonC0IN $11K lost LongNoseDog $310K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes