Arbitrum token Rug Pull

Reported loss $70K
Rugpull

What happened

A fake Arbitrum (ARB) token on BNB Chain at 0x62dfdb6e…Ffaa05, deployed on 16 March 2023 at 14:06 UTC by 0xd9618606…1f1918 and unrelated to the real Arbitrum token. On 31 March 2023 (UTC) CertiK reported that the deployer had removed all of its liquidity; De.Fi's REKT database lists it as an exit scam/rug pull (April 2023) with about $70k reported lost. The verified contract does not contain its own transfer rules: transfer and transferFrom hand execution to the contract at proxyAddr, whose code is not part of this verified source and which whitelisted accounts can swap at any time, and the owner can mint unlimited supply.

How it happened

  1. A holder calls transfer or transferFrom. Neither runs the verified _transfer; both execute proxyAddr.delegatecall(...), so code at proxyAddr, which is not part of this verified source, decides whether the transfer succeeds, using the token's own storage.
  2. The owner can fill _blacklist and _whitelist with addBlacklist and addWhitelist; no opened source shows these were called. The verified code never reads _blacklist in a transfer path, so any use of it would sit in the proxyAddr logic.
  3. setProxyAddr only checks _whitelist[msg.sender] == true, and the constructor whitelists the deployer, so the deployer can point proxyAddr at new code after launch and change buying and selling rules without new verified source.
  4. The owner can call mint(address,uint256) to create any amount of ARB.
  5. On 31 March 2023 CertiK reported that the deployer removed all liquidity from the token's pool.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ARB

Evidence

Same attack technique

Browse all hacks →
OBB $96K lost Script Token $134K lost BWR $47K lost Finance $81K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes