What happened
Ultimate Set Dollar (ULD, contract 0x0473033c…22de3b) lets any account holding the minter role call mint with no cap, and any minter can add further minters with addMinter. De.Fi's REKT database lists the token's minter as an upgradable proxy contract used as a MasterChef-style contract at 0x61ee8806…ad933d, and says an unverified contract at 0x4d01e888…cd7d76 called rebase() on it 12 times, which minted ULD directly to that contract, which then sold it. The deployer added initial liquidity (200 ULD and 200 USDC to the ULD-USDC Uniswap V2 pool) at Tx 0x7695…5e81 on 2020-12-31.
A transaction from the deployer calling advance() on the proxy, Tx 1 0xa02b…dd87, minted 132 ULD from the null address. On 2021-01-02 a wallet called sell() on the unverified contract and swapped 900 ULD through Uniswap V2, Tx 2 0xd138…4b63. No total loss figure is stated.
How it happened
- The token inherits
MinterRole, whosemintis guarded only byonlyMinter:function mint(address account, uint256 amount) public onlyMinter returns (bool) { _mint(account, amount); return true; }. There is no cap on the amount. addMinter(address account) public onlyMinterlets any existing minter grant the role to another address. Which addresses hold the role is contract state, not shown in the source.- De.Fi's REKT database lists the minter as an upgradable proxy used as a MasterChef-style contract at 0x61ee8806…ad933d.
- The deployer seeded the ULD-USDC pool with 200 ULD and 200 USDC in tx 0x76950cb7…635e81 (2020-12-31 19:45:41 UTC, per Etherscan).
- In tx 0xa02b66f1…a3dd87 (2020-12-31 19:08:09 UTC, per Etherscan) the deployer called
advance()on the proxy and 132 ULD were minted from the null address: 100 to the deployer, 12.8 and 19.2 to two other addresses. - De.Fi's REKT database lists the unverified contract 0x4d01e888…cd7d76 as calling
rebase()12 times, minting ULD directly to itself, and then selling. - On 2021-01-02 at 21:51:57 UTC, per Etherscan, a wallet called
sell()on that contract in tx 0xd1388359…cb4b63, routing 900 ULD through the Uniswap V2 ULD-USDC pool for about 0.2167 WETH.
Protocol details
Evidence
- report @CaptainJackAPE incident report twitter.com
- transaction Etherscan tx 0xa02b66f1e5a339aa88793561f47968cc662434b7c8a09b870ca73c465ca3dd87 (advance) etherscan.io
- transaction Etherscan tx 0x76950cb779dc80951a64538edadc3f9bd7bd27aa1e3c2fb5137a6e88f4635e81 (addLiquidity) etherscan.io
- transaction Etherscan tx 0xd13883590ceaedb3ac6249d898e1823e16971c04b4fa9fef0e900a7bb5cb4b63 (sell) etherscan.io
- address Etherscan verified source, Ultimate Set Dollar (ULD) etherscan.io
- address etherscan.io address 0x4d01…txns etherscan.io
- address etherscan.io address 0x61ee…933d etherscan.io
- analysis Sourcify match, Ultimate Set Dollar (ULD) repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
