What happened
On July 28, 2023, traders lost at least $2.2 million in the launch of Pond0x (PNDX), a Pepe-themed memecoin on Ethereum released by Jeremy Cahen, known as Pauly0x. The token's verified contract let anyone move PNDX out of any other holder's wallet. Once people noticed, they began taking tokens from one another, and the price, which had spiked to about $0.36 after liquidity was added, fell close to zero within minutes. The $2.2 million figure comes from an estimate by a memecoin holder known as Rune, reported by Cointelegraph.
Pauly blamed the traders, saying nobody stole anything because the contract was "literally designed as such," and added "GREED KILLS" to the website while denying a rug pull. Cointelegraph reported that within about two hours he began work on a replacement token and promised a compensation dashboard for victims.
How it happened
- The PNDX contract
0x1d4214081985ad20aa3ca93a2206ae792635cbecexposesdirectTransfer(address from, address to, uint256 amount)as apublicfunction. It calls the internal_transfer(from, to, amount)without checking thatmsg.senderisfromor holds an allowance. - A sibling function,
directSpendAllowance, is alsopublicand can change anyone's allowance bookkeeping the same way. - Any caller could pass a victim's address as
fromand their own asto, moving the victim's whole balance in one call. - After the flaw was noticed, holders' tokens were pulled out and sold. PNDX collapsed from its launch spike and buyers lost at least $2.2 million.
Protocol details
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
