What happened
ROBIN HOOD (HOOD) is an ERC-20 token on Ethereum at 0x5db5bbd5…2883de, deployed on 17 July 2023 by 0x31a28754…F39740. Its owner() reads as the zero address from the moment of deployment, which makes it look renounced, but the constructor stores a separate privileged address, _user.user, that the verified code never exposes. That address can flag any wallet through a look-alike function named Approve (capital A), after which every transfer from the flagged wallet reverts, and it can credit itself any number of tokens through a non-standard increaseAllowance without changing totalSupply.
What actually happened was simpler: on 18 July 2023 the deployer removed its Uniswap V3 liquidity position in transaction 0xaba264e8…af9a79, taking about 164.8 WETH (about $313.6K) and about 23.31 billion HOOD out of the pool. Cyvers reported that the ETH was moved to 0x4dd9dd83…e6a294.
How it happened
- The
Ownableconstructor runs_setOwner(address(0));, so the contract never has a visible owner, while theRobinHoodconstructor saves a hidden controller:_user.user = user_;. Approve(address spender, uint256 amount)calls_checkAllowance, which, only when the caller is_user.user, sets_dex[spender] = spender;. This is a blacklist entry disguised as an approval.- Every
transferandtransferFromfirst runs_checkBalance. For a flagged wallet,_decode(sender, _dex[sender])is true and the code subtracts the whole supply,amount = _totalSupply; _minus(sender, amount);, which underflows and reverts, so that wallet cannot sell. increaseAllowance(spender, amount)addsamountstraight to_balances[spender]whenspenderis_user.user, creating tokens with noTransferevent and no change to_totalSupply.- Separately from these code controls, the deployer held the Uniswap V3 liquidity position. On 18 July 2023 it removed that position, withdrawing about 164.8 WETH and 23.31 billion HOOD, and the ETH was moved to another wallet.
Protocol details
Evidence
- report @CyversAlerts incident report twitter.com
- report CyversAlerts: Deployer of $HOOD has removed 164 $ETH twitter.com
- transaction ROBIN HOOD contract creation transaction etherscan.io
- transaction Etherscan transaction 0xaba264e844ac36388f4f2f66b32a4c4e1e24e204fe68b85ec76680174baf9a79 etherscan.io
- address RobinHood verified source code etherscan.io
- address etherscan.io address 0x31a2…9740 etherscan.io
- analysis Sourcify exact match for 0x5db5bbd56bd5b5bd456b537b6759a768ea2883de on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
