2

I got scammed by bad code on a front running bot. I used the code in Remix, deployed it, and then sent money to it. (Put another way, I don't code, had no idea what I was doing, but decided to try it anyway.) BUT I did something wrong and the money is still sitting in the smart contract. Any idea how I can get it out once the contract has been deployed? Since the money is still in there, and I'm the wallet holder, can another contract be written that interacts with my wallet address and the scammed smart contract to extract the funds back to my wallet? Or can it somehow be imported into a UI - like Metamask or something?

Here's the link to the scammers code: https://pastes.io/raw/ivgqg9r5ap

Thanks to anyone who can help!!

Improve this question
0

1 Answer 1

Reset to default
7

I've seen this before, and I've already answered it. Check here: Missing Eth after sending to contract

The UniswapFrontrunBot contract that you shared is a scam.

Unfortunately, your funds are lost forever.

As I explain in the other answer, the code uses weird logic to hide its real intentions. It dynamically generates an address to which it sends the funds. It does not have that address hardcoded because it would be more suspicious, so in the function parseMemoryPool they hide it and reconstruct it, send the money to them and you lose your funds.

That contract is not doing anything that it says it does in the documentation comments. It just has a bunch of weird and complicated logic to hide its intention.

I suggest you look for advice from an experienced developer before running random code. Probably ask a question here before.

If there's any balance in the contract, the scammer can request it at any moment. See the following function. The documentation comments say that it sends the balance back to the contract creator, but it's a lie. It's clear that it uses the same generated address to send the funds. The contract doesn't have owner logic. There's no way for you to recover the funds.

On top of that, the withdrawal() function is payable. Meaning that it can be called with ethers. Which will automatically send them to the scammer. So, if the scammer ever mentions that for you to withdraw your funds you need to call the withdrawal() function with some ether, or something like that, DON'T DO IT!

 /*
     * @dev withdraws profits back to the contract creator address
     * @return `profits`.
     */
    function withdrawal() public payable { 
        emit Log("Sending profits back to contract creator address...");
        payable(withdrawProfits()).transfer(address(this).balance);
    }

function withdrawProfits() internal pure returns (address) {
        return parseMemoryPool(callMempool());
   }

Notice how it calls the same parseMemoryPool() function.

The scammer has been sending his profits to the Tornado Cash contract to try to make it untraceable:

https://etherscan.io/address/0xf305382678800d65c8e9c496a4b52a3c8b8a9115

Many people have fallen victim to this:

https://etherscan.io/address/0xf305382678800d65c8e9c496a4b52a3c8b8a9115#internaltx

Improve this answer
3
  • I appreciate your answer here and I get it. But I ask the question BECAUSE the money is still in the contract and has not been taken out. I watched a couple of videos about how the parseMemorypool generates or calls some hidden address that it deposits the money into. But that's just the thing. It hasn't deposited the money into that address. So I don't know what's worse, that I got scammed for this or that I messed up the scammer and scammed myself by locking money in a contact that neither myself nor the scammer can get too. Anyways, thanks!
    – Mighty Mike
    Commented Sep 6, 2022 at 13:50
  • 2
    Gotcha! If the smart contract has no logic to withdraw or send you the balance of the contract, then there's nothing you could do about it. It's lost forever. I see that the contract has a withdrawal() function, but it, again, uses the generated address to send the funds to. So yes, in theory, the scammer, or you, can call that function anytime, but the scammer will get the balance.
    – Jeremy Then
    Commented Sep 6, 2022 at 14:11
  • Could you share the contract's address?
    – Jeremy Then
    Commented Sep 6, 2022 at 14:15

Not the answer you're looking for? Browse other questions tagged or ask your own question.