Two-key holding contract with the owner burned into the code as a constant and a rotatable spender key for day to day payouts.
Historical Significance
The split is the point. A hot spender key signs the routine payouts and can be replaced the moment it is suspected, while the cold owner key exists only in the bytecode and is needed exactly once per rotation. Putting the owner in code rather than storage also means it survives any storage corruption and is visible to anyone reading the contract, which is a deliberate transparency choice rather than an oversight.
Key Facts
Description
The owner is a compile time constant rather than a storage value, so it costs nothing to read and cannot be changed after deployment. Only that address may call setSpender, which writes the single storage slot.
Everything else answers to the spender. send forwards ether to any address and sendTokens moves an ERC20 balance, both reverting if the caller is not the current spender. The payable fallback accepts ether without conditions.
Source Verified
Heuristic Analysis
The following characteristics were detected through bytecode analysis and may not be accurate.
Byzantium Era
First Metropolis hard fork. Added zk-SNARK precompiles, REVERT opcode, and staticcall.
Bytecode Overview
Verified Source Available
This contract has verified source code.
View Verification ProofShow source code (Solidity)
// Submitted by EthereumHistory (ethereumhistory.com)
pragma solidity ^0.4.24;
contract ERC20 {
function transfer(address _to, uint256 _value) public returns (bool);
}
contract Spender {
address public constant owner = 0x65b0BF8Ee4947edD2A500D74E50a3d757DC79de0;
address public spender;
function () public payable {
}
function setSpender(address _spender) public {
require(msg.sender == owner);
spender = _spender;
}
function send(address _to, uint256 _amount) public {
require(msg.sender == spender);
_to.transfer(_amount);
}
function sendTokens(address _token, address _to, uint256 _amount) public {
require(msg.sender == spender);
require(ERC20(_token).transfer(_to, _amount));
}
}External Links
Related contracts
Msg
Same eraMinimal contract that stores a single public string in state, exposed via the auto-generated m() getter. First of 281 identical siblings. Source verified by EthereumHistory.
0x2c8f58...37b173January 13, 2018Wallet
Same eraToken collection wallet that moves an entire token balance to a chosen address, without the ERC223 callback handler.
0x002204...531195January 19, 2018Wallet
Same eraOwner wallet that forwards ether to its owner, logs any call from a stranger with the full calldata, and lets the owner execute arbitrary calls.
0x001feb...9e7a4fJanuary 20, 2018Sweeper
Same eraMinimal ETH sweeper, first of 1,900 identical deployments in a 2-day burst in January 2018. All sweep to a single hardcoded destination. Source verified by EthereumHistory.
0xeb15f6...6cb3e1January 23, 2018Sweep
Same eraETH sweep-to-fixed-recipient — fallback forwards the contract's entire balance to `0xd293a88c…8d4` via `.send()` and reverts on failure. Massive cluster of 1899 identical deployments — likely deposit-address contracts for a single custodian.
0x00188b...b260a7January 23, 2018Forwarder
Same eraDeposit forwarder in the BitGo style, sending ether to a parent address and able to flush stranded tokens to the same place.
0x00d083...4d5405February 2, 2018