What happened
sonicswap.io (SNIC) was an Ethereum token deployed on 21 December 2020 at 0xfa51c363…df901a by 0xE9e05073…514BA4. It is an unmodified OpenZeppelin ERC20PresetMinterPauser, which gives the deployer MINTER_ROLE to create any number of tokens and PAUSER_ROLE to freeze all transfers. The deployer called mint() to create 100,000 SNIC in transaction 0x7d8c79bb…eda13a and paired all of it with 6 ETH on Uniswap V2 in 0x5f168df6…2c5626.
Less than four hours later, in 0xcab94141…f2f693, the deployer sold 6,567,413.98 SNIC, about 65 times the amount it had put in the pool, for 7.345 ETH, taking back its 6 ETH plus about 1.35 ETH paid in by buyers. De.Fi's REKT database lists this as a rug pull with $824 lost and describes the last transaction as a liquidity removal, but Etherscan shows it as a swapTokensForExactETH sale.
How it happened
- The constructor of
ERC20PresetMinterPausergrants the deployerDEFAULT_ADMIN_ROLE,MINTER_ROLEandPAUSER_ROLE, and the token starts with zero supply. mint(address to, uint256 amount)only checkshasRole(MINTER_ROLE, _msgSender())and has no cap, so the minter can create any amount at any time.- The deployer minted 100,000 SNIC and added it with 6 ETH to a new Uniswap V2 pool, keeping the LP tokens.
- After buyers had paid ETH into the pool, the deployer sold 6,567,413.98 SNIC for 7.345 ETH.
mintis the contract's only way to create tokens, so the extra SNIC had to come from furthermintcalls. - The sale left the pool holding millions of SNIC against little ETH, so buyers' SNIC could no longer be sold for meaningful ETH. The pauser role could also have stopped every transfer through
pause(), but no source shows it was used.
Protocol details
Evidence
- report @CaptainJackAPE incident report twitter.com
- transaction sonicswap.io contract creation transaction etherscan.io
- transaction Etherscan transaction 0x7d8c79bb... (mint) etherscan.io
- transaction Etherscan transaction 0x5f168df6... (addLiquidityETH) etherscan.io
- transaction Etherscan transaction 0xcab94141... (swapTokensForExactETH) etherscan.io
- address sonicswap.io (SNIC) verified contract code on Etherscan etherscan.io
- analysis Web Archive archive.ph
- analysis Sourcify exact match for 0xfa51c363cf42c6c860ef77548fe79a7049df901a on Ethereum repo.sourcify.dev
- analysis De.Fi REKT database listing for SNIC de.fi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
