Zenith Finance Rug Pull

Reported loss $26K
Ethereum
Rugpull

What happened

ZFV (Zenith Finance Vault) is an ERC-20 on Ethereum, deployed on 2020-11-08 by 0xe2868464…6500B9 with a fixed supply of 30,000 ZFV minted to the deployer. De.Fi's REKT database lists the project as an exit scam: it held a fundraising event announced in its Telegram community (archived at Source), the address named in that post, 0xdc553e9b…3d3822, gathered ETH from investors (incoming transfers: Source), initial liquidity was not added, and the funds were distributed between external wallets (Source).

The token code itself cannot be traded the normal way: approve is owner-only and transferFrom debits the caller instead of the token holder, so a holder has no working path to sell ZFV through a standard DEX router. Etherscan shows 57 holders and no exchange listing for the token.

How it happened

  1. The constructor mints the whole supply to the deployer: totalSupply = 30000*10**uint(decimals); followed by balances[msg.sender] = totalSupply;.
  2. Holders receive ZFV through the unrestricted transfer function, which only moves balances (balances[msg.sender] -= value; balances[to] += value;).
  3. approve is restricted: function approve(address spender, uint value) public onlyOwner returns(bool). A holder can never approve a router or pair, which is the first step of any Uniswap-style sale.
  4. transferFrom is also broken for holders: it checks and debits the caller (require(balances[msg.sender] >= value && allowance >= value); then balances[msg.sender] -= value;) instead of from. A router that pulls tokens from a holder would need to own the tokens itself, and the holder's own balance would never be reduced.
  5. The result is that only the owner controls approvals and the original supply, while holders cannot use the standard sell route. Separately, De.Fi's REKT database lists the ETH collected at 0xdc553e9b…3d3822 as taken with no liquidity ever added; the code does not itself move that ETH.

Protocol details

Classification Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract ZFV
Protocol links Website @ZenithFinanceVt

Evidence

Same attack technique

Browse all hacks →
Ethereum Yearnspace $34K lost Ethereum Hype Bet $35K lost Ethereum Rotex $5K lost Ethereum Rubick Finance $21K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes