Terk The Gorilla Rug Pull

Reported loss $122K
Rugpull

What happened

Terk The Gorilla (TERK) was an ERC-20 token on Ethereum traded against WETH on Uniswap V3. On 2023-07-26, the day after deployment, the deployer 0x82d8eE74…fDEd92 removed the pool's liquidity, taking about 65.36 WETH and about 23.1 billion TERK (tx 0x4358608c…4bd1b3); De.Fi puts the loss at $122,440 (65.35 ETH) and Cyvers at about $121K. The funds then moved through other addresses, and on 2023-07-27 60 ETH were split into ten 6 ETH payments with the CoinTool MultiSender (tx 0x0a8f1862…d8bf6f).

The token code also hides extra controls behind misleading names: owner() is zero from deployment, so the contract looks renounced, but a separate address stored at deployment, 0xEA2d426D…5153A2, can credit itself any amount of TERK through the public addLiquidity function and can freeze any holder through Approve (capital A). No opened source shows whether those two functions were used.

How it happened

  1. The constructor mints 33,333,333,333 TERK to the deployer and stores the constructor argument token_ as _tokin.addr. Etherscan decodes that argument as 0xEA2d426D…5153A2.
  2. Ownable's constructor runs _setOwner(address(0)), so owner() returns zero from the start and the token appears ownerless. The real privileges are keyed to _tokin.addr instead.
  3. Hidden mint: addLiquidity(lxpatok, amot, canTrad) is public. When lxpatok equals _tokin.addr, it runs total = _cosum(total, amot); _balances[lxpatok] += total; while subtracting 0 from the caller, so _tokin.addr can be credited any amount without totalSupply changing. Other targets receive nothing.
  4. Hidden blacklist: Approve(xpenter, xamot) checks _encry(uxe, _tokin.addr), so only _tokin.addr can use it; it sets _detxex[xpenter] = xpenter for a nonzero amount, or clears the flag for zero.
  5. Every transfer and transferFrom first calls _rexBaxlat(sender, ...). For a flagged sender it runs tamou = _totSut; _minut(sender, tamou);, subtracting the whole total supply from the sender's balance. Under Solidity 0.8.4 checked arithmetic that underflows and reverts, so a flagged holder cannot sell or move tokens.
  6. What happened on 2023-07-26: the deployer closed its Uniswap V3 position and received about 65.36 WETH and about 23.1 billion TERK (tx 0x4358608c…4bd1b3). The pull used the standard Uniswap V3 position manager, not the hidden functions.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract TERK

Evidence

Same attack technique

Browse all hacks →
zkSync Copycat $202K lost SafeMoonX $25K lost Bare Bear $202K lost Worldcoin $330K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes