What happened
Power of ZUCK (ZUCK) is an Ethereum token deployed on 30 June 2023 at 0x70730A58…50AF4a by 0xa988ACA1…C696e3, which is still its owner. Its owner-only functions addLiquidity and removeLiquidity do not touch any liquidity pool: they add addresses to and remove them from a hidden list called liquidity, and every transfer, transferFrom and approve reverts when a flagged address is the sender, recipient, caller or spender. The owner can therefore freeze any holder, or flag the router or the Uniswap pair to stop trading, under names that read like routine pool management.
De.Fi reported that the deployer removed about 41 WETH (about $76,000) from the liquidity pool and sent the funds to four different externally owned accounts; De.Fi's REKT database gives the figure as 41.04 WETH ($76,646.28) and the removal transaction as 0x898f641a…7be646.
How it happened
- The constructor mints the full supply, 420,000,000,000 ZUCK at 10 decimals, to the deployer, who becomes
owner. addLiquidity(address[] liquidity_)isonlyOwnerand setsliquidity[addr] = truefor each address;removeLiquidity(address account)clears one flag. Despite the names, neither function adds or removes pool liquidity.transferrejects a flagged caller or recipient (require(!liquidity[_msgSender()], "Sender is in array")), so a flagged holder cannot move tokens and nobody can send tokens to a flagged address.transferFromalso checks the token owner, the recipient and the caller, so a router sale fails if the seller, the pair or the router is flagged;approvefails for a flagged approver or spender.- The flag list can be read only by the owner through
getLiquitdityStatus, so holders cannot easily check whether they are blocked. - De.Fi reported that the deployer removed about 41 WETH from the pool and split the funds across four addresses.
Protocol details
Evidence
- report @DeDotFiSecurity incident report twitter.com
- report De.Fi Security: ~$76,000 rug pull alert for $ZUCK twitter.com
- transaction Power of ZUCK contract creation transaction etherscan.io
- transaction etherscan.io transaction 0x898f…e646 etherscan.io
- address Power of ZUCK (ZUCK) verified contract code on Etherscan etherscan.io
- analysis Sourcify exact match for 0x70730A580c7DC0a635029AED8DD5eDB7d150AF4a on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
