What happened
This "Pike Finance" (PIKE) token on Ethereum copied the name of an unrelated project. Its _transfer does not trust the contract's own balance record: it asks a hidden external contract, stored in the books variable, what the sender's balance is and spends from that answer. Whoever controls that external contract can return any balance, whether zero for ordinary holders or an unlimited amount for a chosen wallet.
On 2023-12-26 the address 0x45aF15b2…d7a448 sold more than 999 trillion PIKE, far above the 1 billion supply the code mints, into the Uniswap V2 pool and took about 23.5 ETH (~$52.6K per PeckShield; De.Fi lists $55,233). The token's price fell 100%. Deployer: 0x0C4c3F76…96DF2f.
How it happened
- The constructor calls
_mint(msg.sender, totalSupply_). Inside_mint,at(amount+183232389727193719118)writes the deployer-chosen argument plus a constant into the storage slot ofbooks, so the constructor argument secretly encodes the address of an external contract. _mintthen overrides the argument withamount = 1000000000 * 10 ** 18, so explorers show a normal 1 billion supply.- Every transfer runs
uint256 senderBalance = lovebal(123,false,_balances[sender], sender);, which returnsbooks.dissort(true,u, a). The value returned by the external contract, not_balances[sender], decides whether the transfer passes and what the new balance becomes. - The external contract can therefore make holders' sells fail with
ERC20: transfer amount exceeds balance, or let a chosen address spend tokens it never received. Renouncing ownership does not remove this control; the on-chain owner is now the zero address butbooksis untouched. - On 2023-12-26 at 10:28 UTC, 0x45aF15b2…d7a448 swapped more than 999 trillion
PIKEinto the PIKE/WETH Uniswap V2 pool through the Universal Router (tx 0x707b5227…a19dde) and received 23.5 WETH, emptying the pool.
Protocol details
Evidence
- report @PeckShieldAlert incident report twitter.com
- report PeckShieldAlert: Pike Finance $PIKE has dropped -100% twitter.com
- transaction Etherscan transaction 0x707b5227ea13f772b6bd7accdf79462b0f619fb26edebbbf9db047b7aea19dde etherscan.io
- address PIKE verified contract source, Etherscan etherscan.io
- address etherscan.io address 0x0C4c…DF2f etherscan.io
- address etherscan.io address 0x45aF…a448 etherscan.io
- analysis Sourcify exact match, chain 1, 0x4AD6Da9AAe321C408794E0cA38b37b737484907D repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
