APPLE Rug Pull

Reported loss $30K
Rugpull

What happened

APPLE (APPLE, BNB Smart Chain, contract 0x8F81bbC8…619369) has a fixed supply of 600 tokens that the constructor credits entirely to the deployer, 0xE4C1eEbB…cd0639. Its owner can blacklist any address, which blocks that address from sending or receiving, and the contract blacklists the token's WBNB pair at deployment so only the USDT pair can trade. On 2023-03-19 CertiK Alert reported a large liquidity removal on the token, with the price down about 95% and the deployer removing about $30k from the liquidity pool. De.Fi's REKT database lists the loss as $30,000.

Addresses and transactions listed by De.Fi:

How it happened

  1. The constructor creates two Pancake pairs and sets the rules: uniswapV2Pair = IUniswapV2Factory(_uniswapV2Router.factory()).createPair(address(this), USDT); and a second pair against WBNB, then _balances[mainAddres] = 600 * 10**18;, whiteLists[mainAddres] = true;, whiteLists[uniswapV2Pair] = true;, whiteLists[pointAddress] = true; and blackLists[uniswapV2PairBNB] = true;. mainAddres is the deployer address.
  2. Every transfer first runs require(!blackLists[from], ...) and require(!blackLists[to], ...). Because these check the from and to arguments, a transfer to or from the blacklisted WBNB pair always reverts, and a blacklisted holder cannot sell (from is the holder) or receive.
  3. What the code allows: the owner can call setBlacklistMul (or setBlackListsMul) on any addresses, including the USDT pair, and setWhitelistMul to exempt addresses. A non-whitelisted sender cannot move more than 99.99% of its balance in one transfer (amount > balanceOf(from).mul(9999).div(10000) reverts). Non-whitelisted buys lose 1% and sells lose 2% to pointAddress; the sender is debited the full srcAmount and the receiver gets the reduced amount. There is no mint function, and renounceOwnership exists. No opened transaction shows the blacklist being used.
  4. The token contract does not control the liquidity. The LP tokens belong to whichever wallet added the liquidity, and removing it goes through the router rather than through a function of this token.
  5. What happened, per CertiK Alert: on 2023-03-19 it reported a large liquidity removal on this contract with the price down about 95% and the deployer removing about $30k from the LP.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract APPLE

Evidence

Same attack technique

Browse all hacks →
EC token $44K lost Project culs $278K lost SpaceID $33K lost LightLink token $65K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes