Azoundria: Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/ydtyellowducktokenproxytransferbackdoorexploited.php}} {{Unattributed Sources}} Binance Security ImageThe Yellow Duck Token (YDT), launched on May 24th, suffered a \$41.4k loss due to a vulnerability—or possible backdoor—in its `proxyTransfer()` function, which allowed an attacker to transfer tokens from any address using a privileged account; the..."

2025-08-27T21:40:57Z

Created page with "{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/ydtyellowducktokenproxytransferbackdoorexploited.php}} {{Unattributed Sources}} thumb|Binance Security ImageThe Yellow Duck Token (YDT), launched on May 24th, suffered a \$41.4k loss due to a vulnerability—or possible backdoor—in its `proxyTransfer()` function, which allowed an attacker to transfer tokens from any address using a privileged account; the..."

New page

{{Imported Case Study With About|source=https://www.quadrigainitiative.com/casestudy/ydtyellowducktokenproxytransferbackdoorexploited.php}}
{{Unattributed Sources}}

[[File:Binancesecurity.jpg|thumb|Binance Security Image]]The Yellow Duck Token (YDT), launched on May 24th, suffered a \$41.4k loss due to a vulnerability—or possible backdoor—in its `proxyTransfer()` function, which allowed an attacker to transfer tokens from any address using a privileged account; the incident was reported by TenArmor, and there is no evidence of fund recovery or an ongoing investigation.<ref name="tenarmortweet-20807" /><ref name="bsctransaction-20808" /><ref name="blockthreat-20809" /><ref name="ydttokenbscscan-20810" /><ref name="ydtsmartcontractcreation-20811" />

== About Yellow Duck Token ==
YDT is short for "Yellow Duck Token". The smart contract was launched on May 24th.

== The Reality ==
This sections is included if a case involved deception or information that was unknown at the time. Examples include:

* When the service was actually started (if different than the "official story").
* Who actually ran a service and their own personal history.
* How the service was structured behind the scenes. (For example, there was no "trading bot".)
* Details of what audits reported and how vulnerabilities were missed during auditing.

== What Happened ==
A flaw in Yellow Duck Token’s `proxyTransfer()` function allowed unauthorized transfers, leading to a $41.4k loss.

{| class="wikitable"
|+Key Event Timeline - YDT Yellow Duck Token proxyTransfer Backdoor Exploited
!Date
!Event
!Description
|-
|May 24th, 2025 7:15:20 AM MDT
|Smart Contract Creation
|The Yellow Duck Token smart contract is first created.
|-
|May 25th, 2025 12:16:52 AM MDT
|Suspicious YDT Transaction
|The suspicious transaction is accepted by the Binance Smart Chain.
|-
|May 25th, 2025 4:34:00 AM MDT
|TenArmor Posting Incident Tweet
|TenArmor posts about the suspicious transaction.
|}

== Technical Details ==
"A simple bug (or possibly a backdoor?) in the proxyTransfer() function allows an attacker to transfer tokens from any address by passing in a privileged address."

== Total Amount Lost ==
TenArmor reports losses as $41.4k.

The total amount lost has been estimated at $41,000 USD.

== Immediate Reactions ==
The incident was reported on by TenArmor. It is unclear if the project has any public face.

== Ultimate Outcome ==
It is unclear if any funds have been recovered or any investigation is underway.

== Total Amount Recovered ==
There is no suggestion that any funds have been recovered.

There do not appear to have been any funds recovered in this case.

== Ongoing Developments ==
The incident appears to have faded to history. There's no indication that anything is still being investigated.
== Individual Prevention Policies ==
{{Prevention:Individuals:Placeholder}}

{{Prevention:Individuals:End}}

== Platform Prevention Policies ==
{{Prevention:Platforms:Placeholder}}

{{Prevention:Platforms:End}}

== Regulatory Prevention Policies ==
{{Prevention:Regulators:Placeholder}}

{{Prevention:Regulators:End}}

== References ==
<references><ref name="tenarmortweet-20807">[https://twitter.com/TenArmorAlert/status/1926587721885040686 TenArmor - "Our system has detected a suspicious attack involving #YDT token on #BSC, resulting in an approximately loss of $41.4K. A simple bug (or possibly a backdoor?) in the proxyTransfer() function allows an attacker to transfer tokens from any address by passing in a privileged address." - Twitter/X] (Accessed Jul 31, 2025)</ref>

<ref name="bsctransaction-20808">[https://bscscan.com/tx/0x233b21d0355108593c3f136797aed886ae1d4655384b33d67b1fccee88cdfbc2 Suspicious YDT Transaction - BSCScan] (Accessed Jul 31, 2025)</ref>

<ref name="blockthreat-20809">[https://newsletter.blockthreat.io/p/blockthreat-week-21-2025 Week 21, 2025 - BlockThreat] (Accessed Jul 31, 2025)</ref>

<ref name="ydttokenbscscan-20810">[https://bscscan.com/address/0x3612e4cb34617bcac849add27366d8d85c102efdd YDT Token Smart Contract - BSCScan] (Accessed Jul 31, 2025)</ref>

<ref name="ydtsmartcontractcreation-20811">[https://bscscan.com/tx/0xe758400cb8328afc71f330f852cbc4e7601bc783b5c32256e14fadf28a19a19e YDT Smart Contract Creation - BSCScan] (Accessed Jul 31, 2025)</ref></references>

YDT Yellow Duck Token proxyTransfer Backdoor Exploited - Revision history