What happened
Ren Swap (RSWAP) was an ERC-20 token on Ethereum traded on Uniswap V2. Its hidden _ints check, run on every transfer, is inactive at deployment. Once the owner points _address1 at another address with ints, it rejects any transfer whose sender is not the owner, _address1, the Uniswap router or an owner-listed wallet.
With _address1 set to the pool, buys still go through while holders' sells revert with a fake ERC20: transfer from the zero address error. The deployer added 38 ETH and 250,000 RSWAP of liquidity on 2020-12-08 and removed it about 15 hours later, withdrawing 49.37 WETH and 192,522.7 RSWAP. De.Fi's REKT database lists the token as an exit scam/honeypot with $7,248 lost.
How it happened
- The constructor sets
_address0and_address1to the same owner address and mints the full 500,000 RSWAP supply to it; while they are equal,_intsallows every transfer. _address0can callints(addressn)at any time to set_address1to a different address, which switches the restriction on.- From then on, a transfer that neither comes from nor goes to
_address0must havesenderequal to_address1, the hard-coded Uniswap V2 router or a wallet in_Addressint, or it reverts. - In a Uniswap sale the checked
senderis the holder, not the router, so ordinary holders cannot sell. If_address1is the pool, buys (sent from the pool) still work. multiaddresslets_address0distribute tokens, add chosen recipients to_Addressintand set their router allowance to the maximum, so selected wallets can keep selling.- The deployer added 38 ETH and 250,000 RSWAP to Uniswap in transaction 0x00ba4c81…e1bfe6, then removed the liquidity in transaction 0x1b076b17…96d8df. It received 49.37 WETH, about 11.4 ETH more than it deposited.
Protocol details
Evidence
- report @CaptainJackAPE incident report twitter.com
- transaction Etherscan transaction 0x00ba4c81...bfe6 (addLiquidityETH) etherscan.io
- transaction Etherscan transaction 0x1b076b17...d8df (removeLiquidityETHWithPermit) etherscan.io
- address Ren Swap (RSWAP) verified contract source, Etherscan etherscan.io
- analysis Sourcify exact match, chain 1, 0x90f58bbdccfd41e294cc9cf8ea035d33f4693269 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
