What happened
POOPEPE (POPE) was an Ethereum meme token launched and drained on May 26, 2023. Its owner has two hidden powers: transferr sets the owner's own balance to any number without changing the total supply, and Approvee sets a minimum transfer size for any address, which can be raised above a holder's balance so that holder can never transfer or sell. About seven and a half hours after deployment, the owner 0x73D01eE8…cBB5b6 swapped 10 billion billion POPE, over a billion times the 8.8 billion total supply, into the Uniswap V2 pool for 54.45 ETH.
Artem of De.Fi reported the rug pull and put the loss to holders at about $100,000 (~54 ETH). According to De.Fi's listing, the funds were then distributed to various wallets; the listing also names the address 0xc74d2fe1…fc539c without stating its role.
How it happened
- The token is a standard factory ERC20 with two extra owner-only functions.
transferr(uint256 balan)writes the owner's balance directly:_balances[owner()] = balan;. It does not touch_totalSupply, so explorers still show the original supply. Approvee(address account, uint256 amount)stores a per-address minimum,_meels[account] = amount;, and every transfer enforcesrequire(amount >= _meels[sender], "ERC20: transfer amount is less than minimum allowed");. Setting a minimum above a holder's balance means any amount they try either fails this check or fails the balance check, so they cannot sell.- Both functions use
onlyOwner, and ownership was not renounced: the owner is still the deployer. - On May 26, 2023 at 12:17 UTC the owner swapped 10,000,000,000 billion POPE for 54.45 ETH on Uniswap V2 (tx 0xe5c2dac1…879744). The total supply is 8.8 billion POPE, and
transferris the only function that can give an address more than the supply. - Artem of De.Fi put the loss to holders at about $100,000 (~54 ETH). De.Fi's listing says the funds were then distributed to various wallets.
Protocol details
Evidence
- report @artemDeDotFi incident report twitter.com
- report Artem (De.Fi) rug pull alert on $POPE twitter.com
- transaction Etherscan transaction 0xe5c2dac1...3d879744 etherscan.io
- address POOPEPE (POPE) verified contract source, Etherscan etherscan.io
- address etherscan.io address 0xc74d…539c etherscan.io
- analysis Sourcify match for 0x36206debFAF4C686Be01e5e68fdea66d09B4319a repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
