What happened
Yzer Token (YZER) is a reflection-style ERC20 whose whole supply was minted to the deployer, who is also the owner. The token takes no fees (the fee variables are never set) and has no mint, but the owner can flag any address with antiWhale, after which that address cannot send tokens. On 2023-09-21 the deployer removed liquidity from the YZER/WETH Uniswap V2 pool with removeLiquidityETHWithPermit: Etherscan shows 183,303 LP tokens sent from the deployer 0x050c731a…c379BD to the pool, and 52.3869 WETH plus about 643.11M YZER returned to the deployer, in transaction 0x5fc6a2fc…4994b3.
De.Fi's REKT database lists the incident as an exit scam / rug pull of 28,960 USD (17.38 ETH) and says the funds were moved to another address, 0xdeD9CF64…CFb05C, where they were still held as of 3 October 2023. SlowMist's weekly security report for 17-23 September 2023 lists YZER among that week's rug pulls at about 28,600 USD.
How it happened
What the code allows:
- The constructor mints the full supply to the deployer, who is also the owner:
_owner = msg.sender; _rOwned[_owner] = _rTotal;. The deployer holds all tokens and can provide the liquidity. - The owner can flag any address with
function antiWhale(address _wallet, bool _allow) external onlyOwner(), and_transferrejects flagged senders:require(!_antiWhale[sender], "Whale not allowed");. Becausesenderis the holder whose tokens move, a flagged holder cannot transfer or sell; a flagged pair address would block purchases. The code evidence does not show whether any address was ever flagged. - Fees are not a trap here:
_TAX,_BURNand_LIQUIDITYPOOL_are never assigned a value and the contract has no setter for them, so_getTBasicsreturns zero fees.
- On 2023-09-21 the deployer called
removeLiquidityETHWithPermiton Uniswap V2 Router 2. Etherscan shows 183,303.0278 UNI-V2 LP tokens sent from the deployer to the pool and burned, and 52.3869 WETH and about 643.11M YZER paid out to the deployer (transaction 0x5fc6a2fc…4994b3). - De.Fi's REKT database lists the proceeds as later moved to 0xdeD9CF64…CFb05C.
Protocol details
Evidence
- report De.Fi REKT database listing for Yzer Token (YZER) twitter.com
- transaction Etherscan transaction 0x5fc6a2fc...994b3 (removeLiquidityETHWithPermit) etherscan.io
- address YzerToken verified source code on Etherscan etherscan.io
- address etherscan.io address 0x050c…79BD etherscan.io
- address etherscan.io address 0xdeD9…b05C etherscan.io
- analysis Sourcify match for 0xCBb391907A492a1e721bB16ae0563243E2B71987 repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
