YDT Yellow Duck Token proxyTransfer Backdoor Exploited
Notice: This page is a freshly imported case study from an original repository. While the original content had a similar format, some sections may not have been fully completed. Please help fill in any empty sections or any missing information you can find. If you are new here, please read General Tutorial on Wikis or Anatomy of a Case Study for help getting started.
Notice: This page contains sources which are not attributed to any text. The unattributed sources follow the initial description. Please assist by visiting each source, reviewing the content, and placing that reference next to any text it can be used to support. Feel free to add any information that you come across which isn't present already. Sources which don't contain any relevant information can be removed. Broken links can be replaced with versions from the Internet Archive. See General Tutorial on Wikis, Anatomy of a Case Study, and/or Citing Your Sources Guide for additional information. Thanks for your help!
The Yellow Duck Token (YDT), launched on May 24th, suffered a \$41.4k loss due to a vulnerability—or possible backdoor—in its `proxyTransfer()` function, which allowed an attacker to transfer tokens from any address using a privileged account; the incident was reported by TenArmor, and there is no evidence of fund recovery or an ongoing investigation.[1][2][3][4][5]
About Yellow Duck Token
YDT is short for "Yellow Duck Token". The smart contract was launched on May 24th.
The Reality
This sections is included if a case involved deception or information that was unknown at the time. Examples include:
- When the service was actually started (if different than the "official story").
- Who actually ran a service and their own personal history.
- How the service was structured behind the scenes. (For example, there was no "trading bot".)
- Details of what audits reported and how vulnerabilities were missed during auditing.
What Happened
A flaw in Yellow Duck Token’s `proxyTransfer()` function allowed unauthorized transfers, leading to a $41.4k loss.
| Date | Event | Description |
|---|---|---|
| May 24th, 2025 7:15:20 AM MDT | Smart Contract Creation | The Yellow Duck Token smart contract is first created. |
| May 25th, 2025 12:16:52 AM MDT | Suspicious YDT Transaction | The suspicious transaction is accepted by the Binance Smart Chain. |
| May 25th, 2025 4:34:00 AM MDT | TenArmor Posting Incident Tweet | TenArmor posts about the suspicious transaction. |
Technical Details
"A simple bug (or possibly a backdoor?) in the proxyTransfer() function allows an attacker to transfer tokens from any address by passing in a privileged address."
Total Amount Lost
TenArmor reports losses as $41.4k.
The total amount lost has been estimated at $41,000 USD.
Immediate Reactions
The incident was reported on by TenArmor. It is unclear if the project has any public face.
Ultimate Outcome
It is unclear if any funds have been recovered or any investigation is underway.
Total Amount Recovered
There is no suggestion that any funds have been recovered.
There do not appear to have been any funds recovered in this case.
Ongoing Developments
The incident appears to have faded to history. There's no indication that anything is still being investigated.
Individual Prevention Policies
No specific policies for individual prevention have yet been identified in this case.
For the full list of how to protect your funds as an individual, check our Prevention Policies for Individuals guide.
Platform Prevention Policies
Policies for platforms to take to prevent this situation have not yet been selected in this case.
For the full list of how to protect your funds as a financial service, check our Prevention Policies for Platforms guide.
Regulatory Prevention Policies
No specific regulatory policies have yet been identified in this case.
For the full list of regulatory policies that can prevent loss, check our Prevention Policies for Regulators guide.
References
- ↑ TenArmor - "Our system has detected a suspicious attack involving #YDT token on #BSC, resulting in an approximately loss of $41.4K. A simple bug (or possibly a backdoor?) in the proxyTransfer() function allows an attacker to transfer tokens from any address by passing in a privileged address." - Twitter/X (Accessed Jul 31, 2025)
- ↑ Suspicious YDT Transaction - BSCScan (Accessed Jul 31, 2025)
- ↑ Week 21, 2025 - BlockThreat (Accessed Jul 31, 2025)
- ↑ YDT Token Smart Contract - BSCScan (Accessed Jul 31, 2025)
- ↑ YDT Smart Contract Creation - BSCScan (Accessed Jul 31, 2025)