Symbiosis Rug Pull

Reported loss $24K

Aug 29, 2023

Rugpull

What happened

This record covers a copycat token that used the Symbiosis Finance name and website address, not the real Symbiosis protocol. Its minimal ERC-20 contract has an owner-only function, TransferrTransferr, that overwrites any list of balances with a value the owner chooses. The owner can therefore wipe out holders' tokens or give any wallet an arbitrary balance without changing the reported total supply.

On 2023-08-29 the deployer removed the Uniswap V2 liquidity for 24.77 ETH, and CertiK put the deployer's profit at about $24K. De.Fi lists the loss as 23,725 USD and says the funds were then moved to other addresses.

How it happened

The constructor gives the whole supply to the deployer: _balances[_msgSender()] = _totalSupply;.
The owner can set any balance directly: function TransferrTransferr(address[] memory accounts, uint256 newBalance) external onlyowner { loops over the list and does _balances[account] = newBalance;, emitting only a custom BalanceAdjusted event, not Transfer. Setting a holder to 0 erases their tokens. Setting a wallet to a large value creates tokens that totalSupply() never reports.
Ownership is still with the deployer: owner() returns 0x6be5a66a…80791f. The contract's renounceownership (which would set the owner to 0x...dEaD) has not taken effect.
On 2023-08-29 at 22:25 UTC the deployer called removeLiquidityETHWithPermit in 0xfbf20d43…3c0229. The call burned 10 UNI-V2 and returned about 4.05 billion tokens and 24.7747 ETH from pool 0xED675Ac7…20Ff1c.
De.Fi's listing says the funds went to other EOAs, including 0x353561B3…eE4420 and 0xd77e38e7…06c1de.

Protocol details

Classification Token

Protocol Type Cross Chain Bridge

Affected asset / contract Symbiosis

Protocol links Website @symbiosis_fi

Security review history

Omniscia View report
SlowMist View report
Zokyo View report

Evidence

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes