Snake Eyes Rug Pull

Reported loss $117K
Rugpull

What happened

Snake Eyes (SNAKE) was an Ethereum token traded on Uniswap V3. Its contract contains a hidden per-address block: a justice address fixed at deployment can call a function named Approve (capital A) to give any holder a large weapon value, after which every transfer from that holder reverts, so their tokens cannot be sold. On August 16, 2023 the deployer 0x95c9bB9C…33797f removed its Uniswap V3 liquidity, collecting about 72.1 ETH and 3.63 billion SNAKE; De.Fi's listing puts the loss at $117,292.

According to De.Fi's listing, the funds then moved through several EOAs and about 17 ETH remained at 0x50446734…3b8172 as of August 22, 2023. CertiK reported that an EOA beginning 0xc93A7, which De.Fi's listing gives as 0xc93a7d0f…2a3c72, deposited 60 ETH into Tornado Cash; De.Fi's listing gives 0xafc031a2…2b77d4 as the Tornado Cash transaction.

How it happened

  1. The constructor stores a privileged address passed as snake_: _actors.push(Actor(Main(snake_), Villain(3, true)));. This address is separate from the Ownable owner, so renouncing ownership (the on-chain owner is now the zero address) does not remove it.
  2. The public function Approve(address account, uint256 amount) calls _fight. For any caller other than that address it changes nothing, but for it the branch allowan += amount; _ninja[account].weapon = allowan; writes an arbitrary weapon value for any holder.
  3. Every transfer checks require(amount - _ninja[sender].weapon > 0, "alien");. Under Solidity 0.8 checked arithmetic, a weapon equal to or larger than the amount makes this line revert, so a flagged holder cannot transfer or sell. The check keys on sender, the holder whose tokens move, so it also blocks router sells through transferFrom.
  4. Holders who were not flagged could still trade, so buying looked normal while any wallet could be frozen at will.
  5. On August 16, 2023 the deployer withdrew its liquidity through the Uniswap V3 position manager (tx 0xf7842852…54ecdd), receiving about 72.1 ETH and 3.63 billion SNAKE. De.Fi's listing says the funds then moved through several EOAs; CertiK reported a 60 ETH Tornado Cash deposit from the EOA beginning 0xc93A7, and De.Fi's listing gives 0xafc031a2…2b77d4 as the Tornado Cash transaction.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract SNAKE

Evidence

Same attack technique

Browse all hacks →
Frontfanz $98K lost Friend Tech $456K lost Jigsaw saw you $160K lost Gladiator $246K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes