What happened
The minter of the token contract is an upgradable proxy contract. Upgradable proxy was used as MasterChef contract: https://etherscan.io/address/0x61ee8806…ad933d
The contract deployer added initial liquidity at:
https://etherscan.io/tx/0x76950cb7…635e81
The unverified contract addressed the proxy contract by calling rebase() function 12 times:
https://etherscan.io/address/0x4d01e888…cd7d76#tokentxns
This led to the token mint directly onto the unverified contract, which finally sold minted tokens at:
https://etherscan.io/tx/0xd1388359…cb4b63
The proxy contract was able to mint tokens by calling advance() function:
https://etherscan.io/tx/0xa02b66f1…a3dd87
Case & protocol details
Evidence & learning
Sources and on-chain records
- report Report twitter.com
Practice this exploit pattern safely
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.