A6 Token Rug Pull

What happened

A6 is a BEP20 token on BNB Smart Chain, paired with USDT on PancakeSwap. Its entire fixed supply of 6,868 tokens was minted in the constructor to the deployer address, which the code also exempts from fees. The owner role can raise the buy and sell fee without any cap, switch trading off for every non-whitelisted address, and blacklist a holder so that holder's transfers revert.

CertiK Skynet flagged an exit scam on the contract with 91.38% slippage and roughly $56K taken, and De.Fi's REKT database lists 60,852 USD lost, with the token price falling by more than 90%. Scammer address (as listed by De.Fi): 0x4ecb196c…f383ad.

How it happened

1. The constructor mints the whole supply, _balances[ReceiveAddress] = total;, to 0x4ecb196c6BF588F20330eB6FbE1D8e15e5f383aD, which is also the deployer. The same address is whitelisted: _feeWhiteList[ReceiveAddress] = true; and _feeWhiteList[msg.sender] = true;.
2. In _transfer, the pair-trade checks sit inside if (!_feeWhiteList[from] && !_feeWhiteList[to]), including require(0 < startTradeBlock, "!Trading"); and the fee. A whitelisted sender therefore trades with the pair without a fee and even while trading is closed, while an ordinary holder is subject to both.
3. For ordinary holders the owner controls the terms. setFee(uint256 buyFee, uint256 sellFee) has no upper bound, closeTrade() sets startTradeBlock = 0 so every non-whitelisted pair trade reverts with !Trading, and setBlackList(address addr, bool enable) makes require(!_blackList[from], "blackList"); revert for the listed holder. The fee is taken as feeAmount = tAmount * fee / 10000;, so a sell fee of 10000 makes feeAmount equal to the whole sale amount: the sale goes through, the token contract receives everything and the seller receives 0. A sell fee above 10000 makes tAmount - feeAmount underflow and the sale reverts.
4. claimToken(address token, uint256 amount, address to) lets the owner move any token held by the contract, including the fee tokens and USDT it accumulates, and setFundAddress redirects the fee proceeds to a new address.
5. What happened, per outside sources: CertiK Skynet reported an exit scam on A6 with 91.38% slippage and approximately $56K taken, and De.Fi's REKT database lists the deployer address as the scammer and the loss as 60,852 USD from selling tokens and draining liquidity. The source code does not show which of the functions above, if any, were called; the transactions were not opened for this draft.

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract A6

Evidence

• report CertiK Alert tweet on A6 exit scam twitter.com
• address A6 (A6) verified source on BscScan bscscan.com
• address bscscan.com address 0x4ecb…83ad bscscan.com
• analysis A6 on Sourcify repository (match) repo.sourcify.dev