Popeye the Sailor Rug Pull

Reported loss $241K
Rugpull

What happened

Popeye the Sailor (POPEYE) is an Ethereum token deployed on 22 July 2023 at 0x0f5dd8d6…e2fd93 by 0x436e7d83…da8016. Its Ownable constructor sets the owner to the zero address, so the token looks renounced from the start, while real control sits with a hidden address stored in _info.tokenAddr at deployment. That address can call Approve (capital A) to flag any holder, after which every transfer or transferFrom out of that holder's balance reverts, and anyone can call addLiquidity to credit that address with any amount of POPEYE without changing the reported total supply.

On 23 July 2023 the deployer removed 129.31 WETH and 9.29 billion POPEYE from the token's Uniswap V3 position; Cyvers flagged the removal (about $241,000) and said the funds moved on to other addresses.

How it happened

  1. Ownable's constructor runs _setOwner(address(0));, so owner() returns zero from deployment. The Popeye constructor stores a separate address, _info.tokenAddr = token_;, taken from a deployment argument.
  2. Approve(address spender, uint256 amount) calls _richiedereAllo, which, only when the caller is _info.tokenAddr, sets _dex[spender] = spender for a non-zero amount (or clears it for zero).
  3. Every transfer and transferFrom first calls _assezBalan(sender, ...). For a flagged sender, it runs amount = _totalSupply; _meno(sender, amount);, subtracting the whole supply from the holder's balance, which underflows and reverts under Solidity 0.8. The check is on the token holder (sender), so a flagged holder cannot sell or move tokens at all.
  4. addLiquidity(address spender, uint256 amount) has no access control. When spender equals _info.tokenAddr, it runs _balances[spender] += total; with total equal to amount, while _meno(from, total) subtracts zero from the caller. This credits the hidden address with unlimited new tokens and leaves _totalSupply unchanged.
  5. On 23 July 2023 at 04:03:47 UTC the deployer used the Uniswap V3 position manager to withdraw 129.31 WETH and 9.29 billion POPEYE from the pool (0xcf1eab70…855232), receiving 129.31 ETH. Cyvers reported the funds were sent on through 0x31a74c0e…9b4a9c.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract POPEYE

Evidence

Same attack technique

Browse all hacks →
Worldcoin $330K lost ROACH RACE $160K lost Kaonashi the Faceless $131K lost IEGT $1.1M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes