What happened
Tranquility Defi's TRNQ was a reflection token on Ethereum (0x0bb033ed…3aedf6) that gave its whole 800,000 TRNQ supply to the deployer, 0xcF4C4D29…8406fA. On 30 December 2020 the deployer added 640,000 TRNQ and 10 ETH to Uniswap V2 and received the LP tokens in its own wallet, so it could withdraw that liquidity at any time. Etherscan shows the deployer making several Remove Liquidity calls through the Uniswap V2 router on 9 February 2021, and De.Fi's REKT database lists the case as an exit scam with $12,702 lost.
The contract also gave the owner other powers over holders. Until the owner called enableTranquility, every transfer not involving the owner reverted. The owner could set the tax and liquidity fees with no cap, and above a combined 100% every fee-paying transfer reverts.
LP tokens created by the automatic liquidity feature were minted to the owner.
How it happened
- The constructor credits the full supply to the deployer:
_rOwned[_msgSender()] = _rTotal;with_tTotal = 8 * 10**5 * 10**18. - On 30 December 2020 the deployer called
addLiquidityETHwith 640,000 TRNQ and 10 ETH. The 2,529.82 UNI-V2 LP tokens went to the deployer's own wallet, not to a lock. - The token's automatic liquidity feature also sends its LP tokens to the owner:
uniswapV2Router.addLiquidityETH{value: ethAmount}(address(this), tokenAmount, 0, 0, owner(), block.timestamp). - Holding the LP tokens, the deployer can redeem them for the pool's ETH and TRNQ at any time. Etherscan shows several Remove Liquidity calls from the deployer through the Uniswap V2 router on 9 February 2021, and the deployer's wallet now holds only 0.00042308 UNI-V2.
- The code also allowed other traps, with no transaction seen using them.
require(tranquilityEnabled, "You must meditate on your actions")blocks all non-owner transfers until the owner enables trading.setTaxFeePercentandsetLiquidityFeePercenthave no upper bound, so a combined fee above 100% makestAmount.sub(tFee).sub(tLiquidity)revert on every fee-paying transfer.
Protocol details
Evidence
- report CaptainJackAPE post cited by De.Fi as proof twitter.com
- transaction Etherscan transaction 0xef3e733b...1da9 (initial liquidity) etherscan.io
- address tranquilitydefi.com (TRNQ) verified source code on Etherscan etherscan.io
- address Etherscan address 0xcF4C4D29932CAE67Ae1CbC9cCA653d023a8406fA (TRNQ deployer) etherscan.io
- analysis Sourcify match for 0x0bb033ed58bd5d19bc732249bcd8fceff53aedf6 on Ethereum repo.sourcify.dev
- analysis bloxy.info page 0xcf4c…06fa bloxy.info
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
