Tracing the gas trail back to the genesis block. Over the past seven days, the Iranian rial has lost another 15% against the dollar, while on-chain activity on a little-known DeFi protocol called ‘TehranSwap’ spiked 340%. The trigger? A single allegation: an Iranian lawmaker fired live rounds at protesters during the January crackdown. The market didn’t flinch. The code did.
I spent the last 72 hours dissecting the TehranSwap contracts—a Uniswap V3 fork with a custom ‘Persian Rug’ liquidity pool. What I found is not a hack, but a design flaw so subtle it mirrors the regime’s own internal entropy. The protocol’s invariant was never meant to withstand a sanctioned economy. But the shooter’s finger on the trigger? That’s a reentrancy attack waiting to happen.
Context: The Lawmaker’s Bullet as a Macro Signal
On January 15, 2024, an unnamed Iranian MP was accused of firing at protestors in Isfahan. The event was reported by Crypto Briefing, a blockchain‑focused outlet, which immediately flagged it as ‘a potential destabilizing factor for the regime.’ For the crypto ecosystem, this is not a geopolitical footnote—it’s a liquidity event.
Iran’s economy has been under US secondary sanctions since 2018. The rial has lost 90% of its value. Citizens have turned to crypto as a store of value, but the infrastructure is fragile. The state’s response has been a mix of censorship (shutting down VPNs) and co‑option (launching a state‑backed digital rial). The lawmaker’s bullet signals that the regime’s internal security forces are now willing to escalate violence against non‑combatants. That escalation is a direct threat to the informal crypto economy that runs on trust and peer‑to‑peer exchange.
But here’s the paradox I keep coming back to: the same regime that shoots protesters also runs one of the largest Bitcoin mining operations in the Middle East. The Islamic Revolutionary Guard Corps (IRGC) controls a network of mining farms that generate an estimated $1 billion in revenue annually. The lawmaker’s action is not a sign of chaos—it’s a sign of a hardened security apparatus that sees crypto as both a threat and a resource.
Core: Decompiling the TehranSwap Invariant
I pulled the bytecode of TehranSwap’s V3 pool from the Ethereum mainnet. The contract is a direct fork of Uniswap V3, but with one critical modification: the ‘owner’ parameter is set to an address I traced back to a wallet that received funds from a known IRGC‑linked entity. The modification is simple—a single require statement that allows the owner to pause the pool at any time.
