Ethereum ERC 20 Std. Exploited, Beginning Of Blockchain Spam Advt.?

If you had made an Ethereum transaction within the last three days, then you would have certainly received 232 tokens with the ticker “Just Powh.Io.” This token has now been distributed over 1 million addresses. Even though, it is not going to cause you any monetary loss, the people behind it have shown a way to fill up your wallets with advertisements and other posts which you would not prefer. Imagine having 100s of such useless tokens/advertisements in your wallet. Your won’t even be able to use the wallet properly.!!!!

The spammers have exploited a bug in the ERC20 standard and the way the Ethereum network validates the presence of tokens in wallets. More importantly, this may lead to further flooding of wallets with unwanted messages and advertisements by other similar groups in the future.

Basically, when someone initiates a call to Etherscan asking whether a wallet has token or not, it will use the query function to receive the appropriate reply from the smart contract. The details are then saved and transferred by Ether scan to the Ethereum blockchain, making the tokens materialize in a users wallet without any charges. In this case, the spammers have created a mining program that continues to scan the recent Ethereum blocks and all the wallets within, before pinging each one of them with the query “does the wallet possess token” command. This means, an Ethereum wallet, which is used to perform a transaction will be filled with these 232+ tokens. Barring a few exceptions, most of the wallet which was used to perform an Ethereum transaction in the past three days have received it. If you try to transfer these tokens, then the contract will send you the number of tokens which was previously in your wallet +1.

The spammers are well aware that this format will be soon followed by other groups who wish to advertise their products without any investment. Notably, an Ethereum wallet user will not be able to transfer those coins or delete that transaction permanently. The developers behind this notorious job are well known for these kind of activities. They are the ones who invented the masternode referral link and even spam email.

The spammers have also made this sarcastic Discord announcement a few days ago:

“”Hey @everyone , in our ever-present quest to destroy the ethereum network and have a bit of a giggle on the way down. Today we’ve deployed a contract in a move we like to call OPERATION-PERMANENT-SHITPOSTING. We can consider this phase 2.32 if you’re curious about which stage in our grand scheme of madness we’ve achieved. But we literally just discovered this exploit on etherscan today; so why not abuse it before everyone else does!

This operation is obviously a very-very-serious endeavor. You see, it’s currently using a tad bit of an exploit in etherscan to airdrop everyone 232 tokens. But not JUST any tokens. You see we’re dropping 232 “JUST powh.io” tokens.

Every eth address now has these tokens, period. We just need to use a little trick on etherscan and it permanently recognizes that user’s added them to their account. For the user to go “Wtf is powh.io” the next time they check their wallet. This uhh… this is going to happen to a LOT of eth wallets. We’re pretty sure everyone’s going to be extremely mad, ask how the fuck we did it, and then clone it and EVERYONE’S WALLETS WILL BE FULL OF SHITCOIN ADVERTISEMENTS. We’re sorry, it’s probably worth it.

To make it better, you uhh… you can’t get rid of them. You’re stuck being JUSTED by our powh.io tokens forever. Transferring them actually gives you more of the darn things. :joy:

All eth people angrily or accidentally sent to the wallet, you know in anger or as a pat on the back for us being clever. Is also going to be distributed equally across all p3d token holders. This is actually just a random bonus, and wasn’t part of any roadmap or planned project. We’re just permanently shitposting on the blockchain and in everyone’s ethereum wallet for your benefit”

Lol”

The devs of the Powh.io website (Mantso and P3D_Bot) are behind this. Interested developers can speak to them directly by joining their discord link left in the contract source.