What happened
This "Worldcoin" (WLD) token on Ethereum is a copycat contract that borrowed the name of the Worldcoin project; it is not the official WLD token. Its code gives a hard-coded address the power to wipe any holder's balance through a function named Approve, lets the hard-coded _Owner mint without limit through setRule, and rewrites Transfer events so the owner's movements appear to come from a separate team address. Its renounceOwnership and lock functions have empty bodies and change nothing.
De.Fi's Artem reported on 2023-07-25 that the deployer, worldcoindeployer.eth, had removed 179 WETH (about $330,000) from the token's liquidity pool the day before.
How it happened
_Owneris hard-coded to the deployer, 0x39903b7e…410902, and the contract has no function that changes it.- The constructor calls
setRule(team, initialSupply*(10**18)).setRuleadds the amount to_totalSupplyand to_balances[_Owner], but emits the mintTransferto theteamaddress, so explorers show the supply sitting in a different wallet from the one that holds it.setRulestays callable by_Owner, so the owner can mint more at any time. _transferdebits and credits real balances, then swaps_Ownerforteamin the emitted event, hiding the owner's own sells and transfers.Approve(address[] recipients)can only be called by 0x619be1Ec…Cea009. For each listed address it subtracts the full balance and adds it to_balances[address(0)], so a buyer on the list is left with zero tokens and nothing to sell.executeandclaimAirdroponly emitTransferevents without moving balances, so they can fabricate airdrops or trades in explorer history.renounceOwnership()andlock()carry the_onlyOwnermodifier but have empty bodies, so calling them leaves every privilege in place.- Liquidity withdrawal is not a token-contract function; it depends on who holds the Uniswap V2 LP tokens. De.Fi's alert reports that 179 WETH (about $330,000) was removed from the pool by the deployer.
Protocol details
Evidence
- report @artemDeDotFi incident report twitter.com
- report Artem (De.Fi): Alert: $WLD (Worldcoin) Token Rug Pull twitter.com
- transaction etherscan.io transaction 0x4a55…246d etherscan.io
- address Worldcoin (WLD) copycat token verified contract source, Etherscan etherscan.io
- address etherscan.io address 0x3990…0902 etherscan.io
- analysis Sourcify match, chain 1, 0x4928df618cfe00150f7a12fc9e03829d37fb7d6a repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
