Kekistanians,
Whether you’re trading, hodling or building a project; it seems there are more than enough enemies in this space to keep you on your toes as you tackle the rough seas of defi.
Today we encountered not our first (and likely not our last) enemy in the form of a would-be exploiter. Had he possessed enough braincells to actually carry through with his attempts, the rPepe team and all of Kekistan would have found themselves in a dire situation.
Unfortunately for this baboon, big brain members of Pepe’s Paradise were too quick and efficient in taking down his attempts at exploiting and draining the Uniswap KEK-ETH liquidity pool.
Here’s how things went down:
First, it’s important to take note that the daily burn function for KEK was left as a public function by the developer of rPepe.
Pictured here on the left, you can see the realisation come over him as the exploiter started exploiting.
The burn function being public is not a good idea, and despite some unofficial audits, this was not picked up by anyone until this moment.
It was not long before people began to notice that the KEK rewards pool had vanished, and individual wallets started following suit.
The exploiter was burning everyone’s KEK so he would eventually hold a large majority of the supply. He could then drain the Uniswap pool by trading his KEK for all the Ethereum in the pool.
Great idea. Well done. Congratulations.
Now all he had to do was finish burning all the KEK in everyone’s wallets, then drain the pool and be off with the Ethereum, right?.
Wrong.
What the exploiter had not accounted for, was DAO members smarter than him who with the grace of (insert religious figure here) happened to be present at the time, utilising the public burn function for good:
With no KEK, the exploiter had nothing to drain the pool with. Following this, out of what must have been sheer spite, the exploiter decided to also burn the KEK in the KEK-ETH Uniswap pool. Since he couldn’t access it, he must have thought burning the KEK would omit anyone else from accessing it too.
Clearly if you can’t carry out your nefarious act to completion and make some dishonest money off it, it makes sense to do whatever you can to make life hard for your target.
These kinds of people can never be saved.
Their only desire is to create the misery they seek for company. Otherwise he would have given up after just being blocked. But he didn’t, he spent more gas trying to destroy the project.
Now that the Uniswap Pool couldn’t be accessed by anyone, it seemed that the Ethereum in it would be stuck forever, as it was not tied to any paired token (KEK in this case), and Uniswap wasn’t allowing any trades or liquidity removal.
Luckily the DAO wasn’t done with its big brain activities:
Speed.
As the exploiter hadn’t burned ALL the KEK from EVERYONE’S wallet yet, there were some DAO members with KEK in their wallet. Only one had to send some to the team (who were the first targets and had no KEK at all), and the rest of the plan was to provide the pair with a small amount of KEK to reset the ratio in the pool and drain it BEFORE the exploiter noticed.
And it worked perfectly.
You can see the transaction for the liquidity saving pull here:
https://etherscan.io/tx/0xaad23605229bdf0b6d8d2529205a8595063a1e905c5f368cf00724afebf4a7d0
Saved.
Another day, another baboon conquered. A thrilling chapter in story of rPepe for all involved, and a wonderful example of how the strength of an honest community can overcome the bad actors no matter how devious and pathetic they choose to be.
MOVING FORWARD:
We will have to make a few small changes and have devised a way to do it in the background without affecting our community:
- Fix exploit, and utilise this moment to revise the emission logic
- Take note of holders and farmers of KEK prior to liquidity removal
- Airdrop fixed version while considering how much you would have had if you kept farming. This just takes some maths, but what it means is that however long we take to get back up and running will be calculated into your airdrop. So you will still be earning KEK rewards, even while the farming is technically halted.
Do not move your rPepe token unless the team officially announces to do so.
This is the extreme short term plan to overcome todays shenanigans. After this we will:
- Finalise the last set NFT cards for the first batch of KEKCCG
- Carry on and set dates for the 3 community AMAs we are discussing
- Run the first beta trial of our competitive card game
Lastly we owe a huge thank you to the Paradise members who stepped up and exploited the exploiter before he could cause some real damage.
It really is the spark of positivity this space yearns, and its great to see it exists. We must all notice this in one another, encourage it and reciprocate it. It is the only way.
We will consider this incident a free audit and use it as a learning opportunity while continue to build on this great community.
Until VERY soon,
Pepe Bless.
Etherscan (rPepe): https://etherscan.io/address/0x0e9b56d2233ea2b5883861754435f9c51dbca141
Etherscan(KEK): https://etherscan.io/address/0xbd0d47d7ecf0978f13878615635f3d3dc5fecde1
Uniswap (rPepe):https://app.uniswap.org/#/swap?inputCurrency=0x0e9b56d2233ea2b5883861754435f9c51dbca141&outputCurrency=ETH
Website: https://www.rarepepe.io
Twitter: https://twitter.com/RarePepeToken
Medium: https://medium.com/@rarepepetoken
NFT Museum: https://opensea.io/assets/kek-museum-of-history-and-future
NFT Black Market: https://opensea.io/assets/rare-pepe-black-market
WRITTEN BY
