What happened
overbase.finance (OBASE) was an Ethereum token deployed on 18 December 2020 at 0xe202529b…8e2644 by 0x73fef9Eb…Df8322, with a stated supply of 200,000 OBASE. The contract carries rebase and reflection code, but balances are read only from a private _vOwned mapping, and the owner-only function addTransaction(address destination, uint256 data) adds data straight to any address's _vOwned balance, with no Transfer event and no change to totalSupply. The deployer added 32 ETH and 195,000 OBASE of liquidity in transaction 0xb3a52c45…704847, credited itself 100,000,000 OBASE (500 times the stated supply) through addTransaction in 0x37c4b1c5…6a9433, and sold 100,000,000 OBASE for 38.53 WETH in 0x6baa10d2…48c953, leaving the pool almost empty of ETH.
De.Fi's REKT database also lists a second addTransaction call, 0x1d4f1376…489a66, and a second sale, 0xa312f500…8a2567, which returned only 0.032 WETH, and puts the loss at $4,275.
How it happened
initializerecords a 200,000 OBASE supply (9 decimals) in_vOwned[_msgSender()], andbalanceOfreturns_vOwned[account]; the reflection and rebase mappings_rOwnedand_tOwnednever affect what holders can move.addTransactionis named like a helper for the rebase call list, but its body is_vOwned[destination]=_vOwned[destination].add(data);, so the owner can credit any amount to any address. It emits no event and does not touch_totalSupply.- At 15:50 UTC on 18 December 2020 the deployer seeded a Uniswap V2 pool with 32 ETH and 195,000 OBASE, keeping the LP tokens.
- At 16:06 UTC the deployer called
addTransactionwith itself asdestinationanddata=0x016345785d8a0000, which is 100,000,000 OBASE. - One minute later it sold 100,000,000 OBASE into the pool for 38.53 WETH, more than the 32 ETH it had seeded. A later sale of another 100,000,000 OBASE returned only 0.032 WETH because the pool had little ETH left, and buyers' OBASE could no longer be sold for meaningful ETH.
Protocol details
Evidence
- report @CaptainJackAPE incident report twitter.com
- transaction overbase.finance contract creation transaction etherscan.io
- transaction Etherscan transaction 0xb3a52c45... (addLiquidityETH) etherscan.io
- transaction Etherscan transaction 0x37c4b1c5... (addTransaction) etherscan.io
- transaction Etherscan transaction 0x6baa10d2... (OBASE sale) etherscan.io
- transaction Etherscan transaction 0xa312f500... (OBASE sale) etherscan.io
- transaction etherscan.io transaction 0x1d4f…9a66 etherscan.io
- address overbase.finance (OBASE) verified contract code on Etherscan etherscan.io
- analysis Sourcify exact match for 0xe202529bc704d6297a53d60933616803678e2644 on Ethereum repo.sourcify.dev
- analysis De.Fi REKT database listing for OBASE de.fi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
