What happened
Rotex (RTX) was an ERC-20 token on Ethereum (0x079de196…c753d9) whose comments promise a fixed 25,000 RTX supply to the creator and 3,000 more over three years for staking. In fact the contract hides an unlimited mint in a public function named renounceRole, a name that sounds like giving up permissions. The role check behind it is renamed supportsInterface, and the functions that could add, remove or transfer the minter role are all internal, so the deployer's minting power can never be given up.
On 21 November 2020 the deployer called renounceRole and minted 1,000,000,000 RTX to kingstar.eth (0xB303Cf5A…69A065). Under three minutes later that wallet sold 10,000 RTX on Uniswap V2 for 4.35 ETH, the first of five sales De.Fi lists. The current total supply is 2,000,025,000 RTX.
De.Fi's REKT database lists the case as an exit scam with $4,804 lost.
How it happened
- The constructor makes the deployer the only minter:
constructor () internal { _addMinter(msg.sender); }. - The public function
renounceRole(address account, uint256 amount) public onlyMinterdoes not renounce anything. It calls_mint(account, amount), which adds any amount to the total supply and to the chosen balance. - The minter check is disguised as
supportsInterface(msg.sender), andaddMinter,renounceMinterandtransferMinterRoleare declaredinternal, so no external call can remove the deployer's minting power. - On 21 November 2020 at 15:34:01 UTC the deployer called
renounceRoleand minted 1,000,000,000 RTX to 0xB303Cf5A…69A065 (kingstar.eth), against a stated supply of 25,000. - At 15:36:46 UTC that wallet swapped 10,000 RTX for 4.35 ETH through the Uniswap V2 router (transaction 0xf8b2ebe3…7e0da6). De.Fi lists four further sales, which drew ETH out of the pool that other holders sold into.
Protocol details
Evidence
- report CaptainJackAPE post cited by De.Fi as proof twitter.com
- transaction Etherscan transaction 0x23481a28...3789 (renounceRole mint) etherscan.io
- transaction Etherscan transaction 0xf8b2ebe3...0da6 (first sale) etherscan.io
- transaction etherscan.io transaction 0x70bc…2f84 etherscan.io
- transaction etherscan.io transaction 0x759a…6c32 etherscan.io
- transaction etherscan.io transaction 0xe5a9…0452 etherscan.io
- transaction etherscan.io transaction 0xe970…6546 etherscan.io
- address Rotex (RTX) verified source code on Etherscan etherscan.io
- analysis Web Archive web.archive.org
- analysis Sourcify match for 0x079de196d5e8babca45f7d621fe0127f4dc753d9 on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
