Pond0x's directTransfer() function allowed any account to transfer tokens from any other address without authorization. The function exposed an internal _transfer function with no access controls, enabling attackers to drain funds by moving tokens from any address to their own.

A serious flaw in Pond0x, the Pepe the Frog-branded MEME coin launched by Pauly0x, caused traders to lose at least $2.2 million after it was discovered that anyone could transfer tokens belonging to someone else. People quickly started scrambling to steal money from each other. Pauly0x responded by blaming traders who were buying and selling tokens, with various Twitter posts the next day saying he was teaching people a lesson that it wasn’t his fault that people lost money. He wrote to angry traders accusing him of rug pulling. He added a message to the website: "GREED KILLS".