What happened
solv3.network (SLV3) was an Ethereum token whose contract let only a small set of addresses sell. A hidden safeCheck modifier records the first address the owner sends tokens to (normally the Uniswap pair) and afterwards accepts transfers only from that address, the Uniswap router, the owner and wallets the owner whitelisted. Anyone could buy, but ordinary holders' sells reverted with a misleading "transfer from the zero address" error.
The deployer added 200 ETH and 6,000 SLV3 of liquidity on 2020-12-01 and removed it about 13.5 hours later for 256.41 ETH and 4,686.22 SLV3, a net gain of about 56.4 ETH taken from buyers. That is in line with the roughly $35.6k loss De.Fi lists.
How it happened
- The constructor sets both control slots to the owner and mints the whole supply there:
_address0 = owner; _address1 = owner; _mint(_address0, initialSupply*(10**18));. - The first transfer the owner sends rewrites
_address1:if(sender==_address0 && _address0==_address1){_address1 = recipient;}. When the owner adds liquidity, that recipient is the Uniswap pair. - From then on, any transfer not involving the owner must come from an allowed sender:
require(sender == _address1 ||sender==_router || _Addressint[sender], "ERC20: transfer from the zero address");. Buys pass because the pair is the sender. A holder's sell has the holder as sender, so it reverts. - Only the owner can exempt wallets:
multiaddresssets_Addressint[receivers[i]] = truefor the firstAllowNreceivers whenmsg.sender == _address0.ints(address addressn)lets the owner point_address1anywhere. - Deployer 0x22Bb9364…f82aAE deployed the token and minted the supply in 0xb5fd23d5…7a0f9c. It added 6,000 SLV3 and 200 ETH to Uniswap V2 in 0x542e5104…76fcaf on 2020-12-01 14:14 UTC.
- On 2020-12-02 03:52 UTC the same address burned all 1,095.4451 UNI-V2 LP tokens through
removeLiquidityETHWithPermitin 0x365322fa…633c84, receiving 256.41 ETH and 4,686.22 SLV3.
Protocol details
Evidence
- report Crypto94 (@CryptoExpert101) on X: New Scam: solv3.finance twitter.com
- report @CaptainJackAPE incident report twitter.com
- transaction Etherscan transaction 0x542e5104... (addLiquidityETH) etherscan.io
- transaction Etherscan transaction 0x365322fa... (removeLiquidityETHWithPermit) etherscan.io
- transaction etherscan.io transaction 0xb5fd…0f9c etherscan.io
- address solv3.network (SLV3) ERC20 contract source, Etherscan verified code etherscan.io
- analysis Sourcify repository: chain 1, 0xa2FFFdc6EFb2b76109519F23D84d3F6122e1D639 (ERC20.sol) repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
