Blockchain security firm SlowMist has issued a security alert detailing an exploit targeting Four.Meme, a newly launched meme token on Binance Smart Chain (BSC). The attacker leveraged a vulnerability that allowed them to bypass transfer restrictions and manipulate liquidity on PancakeSwap before the token’s official launch.‍

How the Attack Happened

According to SlowMist, the attacker used the 0x7f79f6df function of Four.Meme to acquire a small amount of tokens before the official launch. They then sent these tokens to a PancakeSwap Pair address that had not yet been created. 

This move enabled the attacker to establish the liquidity pair themselves and add liquidity at an unintended price, sidestepping the MODE_TRANSFER_RESTRICTED mechanism designed to prevent unauthorized transfers before launch.

By exploiting this loophole, the attacker was able to drain liquidity from the pool, impacting investors who had planned to participate in the token launch.‍

Response from Four.Meme

Following the discovery of the attack, Four.Meme promptly suspended its launch function to conduct an emergency investigation. The project team assured affected users that they would be compensated and opened a damage submission form to collect relevant information from victims.

After a comprehensive security review, Four.Meme announced that it had resumed the launch function with reinforced security measures. The team has since implemented fixes to prevent similar attacks in the future and has begun the process of compensating affected users.

While Four.Meme has taken swift action to address the exploit and support its community, the event serves as a reminder for investors to remain cautious when engaging with newly launched tokens.

Investors are advised to follow updates from the Four.Meme team for further developments on compensation and security measures.