CAW Observatory 日本語
Observed #45

Nobody Can Freeze It, So Nobody Can Give It Back — What Sits Inside CAW's Own Contract

Nobody Can Freeze It, So Nobody Can Give It Back — What Sits Inside CAW's Own Contract
CAW's contract has no owner. No mint, no pause, no blacklist — nobody can freeze your balance and nobody can print more (see the archive entry "CAW's Vessel — Twin Contracts Born From the Same Mold"). That design has a quieter flip side. Nothing that lands in this vessel by mistake can ever be handed back. ❶ So we counted what is inside. CAW's own contract address holds 35 different ERC-20 tokens, plus one NFT: 349.59 billion CAW, 7,210.59 USDT, 749.97 USDC, just over 10 million SHIB, about 0.005 WETH. ETH: none — and it could not take any if someone tried, because the contract has no `receive` and no `fallback`. (All balances as of Jul 31, 2026, 14:55 UTC, block 25653575. Anyone can send here, so they can grow.) ❷ "35" is not a number the explorer will show you. Blockscout returns 32 rows, one of which is that NFT, so only 31 ERC-20s appear. The other four surface only if you ask each token contract directly (`balanceOf`). Their names: Fear the Old Blood, Morning Always Comes, Ryoshis Worst Nightmare, and Chirr. The first two are lines from Bloodborne — the same source as A Hunters Dream, which is CAW's own full name. Elsewhere in the pile: `A Fall of Moondust` (the Arthur C. Clarke novel), `A Yogis Joy` (Milarepa), and 6,666,666,666 units of a token named simply `Judas` — the same run of sixes as the 666,666,666,666,666 total supply. ❸ Why can none of it come out? "There is no withdraw function" is the weak version of that answer. We read the code that actually runs instead. This contract's runtime is 2,278 bytes and 1,354 instructions, and among them there is not a single `CALL` — no `DELEGATECALL`, `STATICCALL`, `CREATE` or `SELFDESTRUCT` either. Moving even one unit of another token means calling that token's contract. This vessel was never given the instruction. So it isn't "locked forever" — this vessel simply has no means. ❹ Here is where it gets strange. Open the address in an explorer and you will find 532 outgoing rows, from a contract that cannot send anything. Look closer: 523 of them are a token called `HUM`, and this address has never received a single HUM and holds none of it. You cannot send 523 times what you never had. What actually happened was one transaction, on Apr 18, 2022, in which HUM's own contract emitted 523 events saying the sender was this address. The other nine rows are the same trick, and all four tokens involved date to Apr 17–18, 2022 — before CAW's own first incoming transfer on Apr 21. ❺ The same thing happens with the NFT. The one NFT sitting here is `A Hunters Dream Mysterybox NFT` (symbol: `caw.gift`), and it displays CAW's deployer as the sender. Someone else sent it. The mechanism is in the setup: the transaction that created that contract carries the deployer's address written straight into its arguments. The sender is a field whoever deploys gets to fill in. The deployer's own signatures number 16 in total, the last on Oct 31, 2022 — and this NFT was created 386 days after that. ❻ The NFT is stranger still. Transfers and approvals both revert when called. And asking it for a balance returns 1 for every address you try — addresses that never received it, addresses nobody has ever used. There is no ledger of owners at all. Its description reads: "You received this NFT for being a holder of A Hunters Dream! Holders of the CAW NFT can exchange this for CAW rewards." CAW is an ERC-20; a "CAW NFT" does not exist. The only route to any real harm is the website that description points at — we did not open it, so what happens there is unverified. So here is the practical part. Leave the NFT where it is. Transfers and approvals cannot even be called on it, so nothing is going to happen inside your wallet. You cannot delete it, and you do not need to. The one thing to be careful with is the website its description points to. We have not checked what that site does — and there is no reason to connect a wallet, or to sign whatever it asks for, on a site nobody has checked. Not opening it is the safest answer. ❼ None of this was aimed at CAW. The same `<project> Mysterybox` build shows up more than 30 times on the first page of an explorer search — `aave-nft.gift`, `gnosis.gift`, `radix.gift`, `illuvium.gift`, `saitama.gift`, and on it goes. The same trick has landed on SHIB's contract and on LINK's. CAW got two rounds, twelve transactions, no special treatment: a mass-production kit reading holder lists by machine. And this vessel was on that list because it holds 349.59 billion CAW. (Worth adding: the explorer labels this NFT as not a scam. No warning is shown.) ❽ One thing to be plain about: the CAW sitting in here is not subtracted from the total supply. CAW's total is a fixed 666,666,666,666,666, and these 349.59 billion are still counted inside it. Out of reach is not the same as gone. Why we saved this: counting the contents, one thing keeps surfacing. What the chain preserves is who signed — not who a record says sent it. The 523 sends say it. The delivered NFT says it. A display is something anyone can write; a signature is not. And when the counting was done, what lay deepest in the vessel were words from the same place CAW's own name came from. Nobody knows who sent them, or why. Probably nobody can take them out. They are simply there — Fear the Old Blood, and Morning Always Comes. 🐦‍⬛

Source

publicnode RPC (eth_call / eth_getCode) · Blockscout · IPFS ↗

Open in the Observatory