Partnered With:

Explore the implementation principles and preventive measures of "Delayed Pixiu"

Read this article in 6 Minutes

In the dark forest of Crypto, malicious developers’ methods are constantly escalating.

Original Title: "Understanding the Implementation Principles and Prevention Measures of 'Delay Pika' in One Article"

Source: Odaily Star Daily

The token Pixiu usually refers to a situation where a token can only be purchased but not sold, and the developer will withdraw LP profits after a period of time, resulting in a Rug Pull for buyers. Delayed Pixiu is when a token can be traded in the short period of time when it first opens for trading, but then becomes a Pixiu state. For this type of Rug Pull technique, many contract detection tools have not yet added corresponding detection functions, making it one of the main profit methods for malicious developers.

Below, Odaily Star Daily will provide a brief overview of the principles of ERC20 and Uniswap, and explain how Delayed Pippi is implemented.

Note: Some of the classifications in the article are not completely rigorous for the sake of understanding.

ERC 20 Basics

Most tokens in the market follow the ERC-20 standard, but what is ERC-20? ChatGPT's answer is as follows:

ERC-20 is a token standard on the Ethereum blockchain that defines a set of rules and interfaces that token contracts must follow. This standard specifies the basic functions of tokens, including transfer, balance inquiry, and authorization for others to spend tokens on behalf of the owner.

Here are some of the main ERC-20 token standard rules and features:

Transfer: ERC-20 tokens can be transferred through smart contracts, allowing users to send tokens to other Ethereum addresses.

Balance inquiry (BalanceOf): Users can inquire about their ERC-20 token balance to view the quantity of tokens they possess.

Balance Inquiry (BalanceOf):

Actually, this function not only has a "query" function, but also defines how many tokens the user "owns". Each token can be understood as a "bank", and each wallet address obtains a "savings card" from the "bank" after trading tokens, which records the balance of each address. Users can apply to the bank to inquire about their balance, or request asset changes for transactions.

Note: Ethereum adopts an Account-Based model.

Therefore, users do not essentially "own" their assets, but rather a function "defines" the amount of tokens they can "spend".

That is: X Token Balance Of [A Account] = The number of X tokens that A Account can spend externally.

Note: Bank deposits in the real world are debts of the bank to its customers, and the bank has ownership of the assets.

Transfer

All ERC-20 tokens need to perfect the transfer function. Based on the previous ledger model, when a transfer occurs, it is not that account A "delivers" tokens to account B, but rather that account A deducts token quantity X and account B increases token quantity X.

That is: Balance Of [A Account]-X and Balance Of [B Account]+X

Developers can modify the transfer function to restrict the transfer amount and transferor.

The transfer function is the fundamental source of most chimaera mechanisms.

Uniswap

In the previous section, each token was compared to a "bank". Therefore, Uniswap can be understood as an accepting intermediary, exchanging two tokens through the AMM principle of xy=k.

The exchange process is as follows:

User transfers token A to Uniswap contract.

- Uniswap will calculate the tokens to be returned based on y=k/x and deduct the handling fee from the received tokens.

- Uniswap transferred token A to the LP pool and withdrew token B.

- Uniswap transfers token B to users.

Of course, Uniswap actually involves multiple functions and processes. The key point to understand here is that Uniswap only trades based on "received tokens", and the quantity may have changed when users perform "transfer" operations.