What happened
Rubixi was a Ponzi-style Ethereum contract, deployed on March 14, 2016 at 0xe82719202e5965Cf5D9B6673B7503a3b92DE20be by 0xdD68da49B2a0c46eB508bD4f18044B5C6268ad60 (deployment tx 0x4496b64234e97bb7ed008d09938fb9e94ecf3461cbd89a5eabda356a098f8ec3). It paid earlier depositors from later deposits and let the owner collect a fee on each deposit. During development the contract was renamed from DynamicPyramid to Rubixi, but its constructor kept the old name, DynamicPyramid().
In the Solidity of the time, a constructor had to share the contract's name. Because the names no longer matched, DynamicPyramid() compiled as an ordinary public function that set owner = msg.sender. Anyone could call it, become owner, and withdraw the collected fees.
On April 11, 2016, a user on the project's Bitcointalk thread posted that he had made himself owner and changed the payout multiplier and fees. By the next day users there were openly taking turns hijacking ownership. About 4 ETH is still held by the contract.
Ownership calls such as changeOwner were still being made in 2023 (tx 0x9385dca4891753f8ba5817964e5321849b5c7172f5a669aee144344d0610684c).
How it happened
- The developer renamed the contract from DynamicPyramid to Rubixi but left the constructor named
DynamicPyramid(), so it compiled as a public function that anyone could call. - An attacker called
DynamicPyramid(), which setownerto the caller. - As owner, the attacker called
collectAllFees()(or the other owner-only functions) to send the accumulated fees to themselves, and could change parameters such as the payout multiplier and fee. - Other users repeated the call to take ownership back, turning the contract into a free-for-all over its fees.
Protocol details
Evidence
- report Report hackenproof.com
- transaction Etherscan: Rubixi deployment tx etherscan.io
- transaction Etherscan: changeOwner tx 0x9385dca4...684c etherscan.io
- transaction etherscan.io transaction 0x5802…d472 etherscan.io
- address Etherscan: Rubixi contract etherscan.io
- address etherscan.io address 0xdd68…ad60 etherscan.io
- code awesome-smart-contract-bugs (Rubixi entry) github.com
- analysis A survey of attacks on Ethereum smart contracts (Atzei, Bartoletti, Cimoli), section on Rubixi eprint.iacr.org
- analysis Bitcointalk: Hi! My name is Rubixi (page 4) bitcointalk.org
- analysis Bitcointalk: Hi! My name is Rubixi (page 3, posts #41-60) bitcointalk.org
Understand the attack patterns
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
