Toothless - How to train meme Rug Pull

Reported loss $186K
Rugpull

What happened

TOOTH ("Toothless - How to train meme") was an Ethereum meme token deployed on 2023-07-18. On 2023-07-19 Cyvers flagged transaction 0x82a9a63d…48b681, in which the token's deployer removed about 97 ETH (about $186,000) from the Uniswap V2 liquidity pool. The verified contract looks renounced because its Ownable constructor sets the owner to the zero address, but control sits with a separate hidden address, _token.token, set at deployment.

That address can flag any holder through a capitalised Approve() function so every later transfer from that holder reverts, and anyone can call addLiquidity() to credit it with any number of tokens without a Transfer event or a change to totalSupply.

How it happened

  1. The constructor stores a private address in _token.token = token_;, while Ownable's constructor calls _setOwner(address(0)), so owner() reads as the zero address from deployment and the token appears renounced.
  2. The hidden address can call Approve(holder, amount) with any non-zero amount; _requireAllow then runs _cex[spender] = spender;, marking that holder.
  3. Every transfer and transferFrom first calls _isEnoughBalance(sender, ...). For a marked sender it sets amount = _totalSupply; and calls _moins(sender, amount), which subtracts the whole supply from the holder's balance; Solidity 0.8.19's checked arithmetic reverts, so a marked holder cannot sell or move tokens. The check uses the token owner (sender), so it also blocks sales routed through transferFrom.
  4. addLiquidity(spender, amount, isOwner) is public and only requires isOwner == true. When spender is the hidden address, it debits the caller by total = 0 and then adds amount to _balances[spender], giving that address unlimited tokens with no Transfer event and no change to totalSupply.
  5. On 2023-07-19 the deployer removed about 97 ETH from the Uniswap V2 pool in 0x82a9a63d…48b681, per Cyvers, which reported the funds at 0xdd614517…0f6790.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract TOOTH

Evidence

Same attack technique

Browse all hacks →
Gandalf The Grey $266K lost Scooby Pepe $238K lost Patex $122K lost ROBIN HOOD $313K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes