AORcoin Rug Pull

Reported loss $52K
Rugpull

What happened

AORcoin (AOR) is a BNB Chain token at 0x8e404e8c…8f363a, deployed on 24 June 2023 by 0xf0396dA5…Dd8380, which still holds the owner role. Its code gives the owner several ways to trap holders: updateTrade adds any address to a blocklist that stops it from sending tokens, the buy, sell and transfer fees and the post-buy sell lock can be set with no upper limit, and a built-in decay that shrinks every ordinary holder's balance each period runs at a rate the owner can change. Sales also depend on an external bot-checking contract that the owner can replace.

CertiK reported on 22 July 2023 that about $51,000 in BSC-USD was removed from the AOR liquidity pool by the externally owned account 0xf600d.... De.Fi's REKT database lists the event as a rug pull, with the liquidity removed in a single transaction, 0x867e4d19…fc834d, by 0xf600d4d9…69eb87, for a loss of $51,693.

How it happened

  1. The constructor credits all 10,000,000,000 AOR to the deployer, exempts the deployer and four hard-coded fee wallets from fees, and creates the BSC-USD pair.
  2. updateTrade(addr, false) is onlyOwner and adds addr to _tradeSet. _transfer then reverts with require(!_tradeSet.contains(from),"from address is blocked"), so a listed holder cannot sell or transfer, and a listed address cannot receive tokens from the pair.
  3. setSellRate, setBuyRate and setTransferRate take any uint8 value. At 100 the whole amount goes to the fee wallets; above 100, amount*(100-feeRate) underflows and the transfer reverts. setLockTime can raise the required wait after a buy (require(time-accountInfo[from].buyTime >= config.lockTime, "sell locked")) to about 136 years.
  4. Non-exempt balances decay every burnPeriod (900 seconds by default) by the factor burnRate / 1e8; on the next transfer the difference is taken from the holder, half to address(0) and a quarter each to addressA and addressB. setBurnRate has no bounds, so a rate of 0 would reduce ordinary holders' balances to zero after one period.
  5. Sales revert when the external _ibot.isBotAddress(from) returns true, buys by contracts or by addresses other than tx.origin are burned, and setAddressIBot lets the owner swap in a different bot contract.
  6. CertiK reported that about $51,000 in BSC-USD was removed from the pool by 0xf600d...; De.Fi lists removal transaction 0x867e4d19…fc834d.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract AOR

Evidence

Same attack technique

Browse all hacks →
Kaonashi the Faceless $131K lost IEGT $1.1M lost Wettok Market $190K lost Gandalf The Grey $266K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes