Artificial intelligence robot Rug Pull

Reported loss $152K
Rugpull

What happened

Artificial intelligence robot (AIT) is a BEP20 token on BNB Chain (contract 0xD5B33544…F43EF7), deployed on 2022-07-03 from 0x26b327f9…58cf33. Its verified code gives the owner, who receives the entire supply and is exempt from fees, two levers over every other holder: EnemyAddress can blacklist any address from sending or receiving, and the buy/sell fee percentages have setters with no upper limit. On 2022-11-15 CertiK's Skynet alert reported an exit scam on AIT with a drop of more than 89.3% and about $152K taken by the contract deployer; De.Fi's REKT database lists a rug pull of 152,000 USD and says the deployer removed liquidity from the pair contract and sold a large quantity of tokens, giving 0xae6995d1…2f31c3 as an example sale transaction.

The price fell by roughly 90%. The code does not show whether the blacklist or fee setters were used, and the contract currently reports the zero address as owner.

How it happened

  1. The constructor mints the full supply to the deployer and exempts it from fees: excludeFromFees(owner(), true); and _cast(owner(), totalSupply);. The owner can therefore sell without paying fees and is skipped by the fee-swap trigger (from != owner()).
  2. The owner can blacklist any wallet or the pool. EnemyAddress(address account, bool value) external onlyOwner sets _isEnemy, and _transfer starts with require(!_isEnemy[from] && !_isEnemy[to], 'Enemy address');. A flagged holder can neither send nor receive; flagging the pair address would stop every buy and sell.
  3. The owner can raise fees without a cap. setMarketingFee and setLpRewardFee assign the value directly, and takeAllFee computes uint256 feeAmount = amount.mul(fees).div(100);.
  4. At a total fee of 100 the sender is debited the whole amount: super._transfer(from, address(this), feeAmount); leaves amountAfter at zero, so the recipient (for a sell, the pair) receives nothing. Above 100 the line amountAfter = amountAfter.sub(feeAmount); reverts, so every transfer by a non-exempt wallet fails. Fee-exempt addresses (owner, marketing wallet) are unaffected.
  5. The owner can redirect the fee proceeds: swapAndSendFee pays BNB to marketingWalletAddress, which setMarketingWallet can change.
  6. What was reported: CertiK recorded an exit scam with a drop of more than 89.3% and about $152K taken by the deployer, and De.Fi's listing describes liquidity removal from the pair and a large sale by the deployer. Neither source opened shows a blacklist or fee-setter call, and removing liquidity is not controlled by this token's code.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract AIT
Protocol links Website @AICoinOfficial

Evidence

Same attack technique

Browse all hacks →
SSPF $126K lost Cezar Hard Fork $399K lost SCAT $26K lost DeFi Safe $127K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes