What happened
YFFC (yffc.finance) was a YFI-style token whose supply was not fixed: any address on a minter list can call mint, and the deployer controls that list through a governance address. De.Fi's REKT database lists the project as an exit scam / rug pull with a loss of about 72,446 USD, and the investors collectively lost approx. $72k. The live text lists the sequence as follows.
The deployer added initial liquidity (tx 0x02cf382c…355d94). About two months later, once the token traded at a price the deployer accepted, the deployer called mint to create new tokens for an external wallet (tx 0x39cecb2f…d99064). The external wallet sold the new tokens almost immediately (tx 0xc3d42e64…c88c5f).
Addresses: deployer 0xe28db60e…c99ec4 and a second address 0xa360d8e3…330a9a. The Etherscan page for the mint transaction shows the deployer calling mint on the YFFC contract on 2020-11-06 at 06:13 UTC for 2,500,000 YFFC to 0xA360D8E3…330A9A.
How it happened
- The constructor sets
governance = tx.origin;, so the deploying account is the governance address.setGovernancelets it hand that role to another address. addMinter(address _minter)is callable only bygovernanceand setsminters[_minter] = true. Governance can add any address, including itself, as a minter.mint(address account, uint256 amount)requires onlyminters[msg.sender]and then runs_mint(account, amount). There is no cap and no limit per call, so a minter can create any amount of YFFC for any address._transferis the plain ERC20 version with no sell block, tax or blacklist, so the minted tokens move into a Uniswap pool like any other transfer. Selling them there takes the ETH that buyers paid in.- What happened: Etherscan shows the deployer calling
minton 2020-11-06 for 2,500,000 YFFC to 0xA360D8E3…330A9A. De.Fi's listing says that wallet sold the tokens almost immediately (tx 0xc3d42e64…c88c5f) and records a loss of 72,446 USD.
Protocol details
Evidence
- report Report web.archive.org
- transaction Etherscan transaction 0x39cecb2fc17908fae64c7c6fce23b7d742cd68f2a1d25b0111cbeb0b6ad99064 etherscan.io
- transaction etherscan.io transaction 0x02cf…5d94 etherscan.io
- transaction etherscan.io transaction 0xc3d4…8c5f etherscan.io
- address Etherscan verified source, yffctoken 0xea004e8FA3701B8E58E41b78D50996e0f7176CbD etherscan.io
- address etherscan.io address 0xa360…0a9a etherscan.io
- address etherscan.io address 0xe28d…9ec4 etherscan.io
- analysis de.fi Analysis t.me
- analysis Web Archive web.archive.org
- analysis Sourcify repository entry for yffctoken repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
