What happened
Astronaut NFT (AST) is a BEP20 token on BNB Smart Chain whose verified contract gives the owner an uncapped mint function, a blackListAddress function and a pause switch. De.Fi's REKT database lists it as an exit scam / rug pull of 187,400 USD dated 2021-02-08, and states that the contract deployer called mint() to create new tokens onto its own wallet (transaction 0x7d4e6e05…db40dc) and then sold tokens multiple times starting from transaction 0xa23f6f33…5fd953. Because mint has no cap, tokens created this way dilute every other holder and can be sold into the pool against its paired assets.
The transaction pages were not opened, so the mint and sale are attributed to the De.Fi listing.
How it happened
- Code allows: the constructor sets the supply and gives all of it to the owner passed in as an argument:
totalSupply = _supply * 10**_decimals; balances[tokenOwner] = totalSupply; owner = tokenOwner;. - Code allows: the owner can create tokens without limit and send them to any address:
function mint(address account, uint256 amount) onlyOwner public { totalSupply = totalSupply.add(amount); balances[account] = balances[account].add(amount); ... }. There is no maximum supply, cap, delay or role split. - Code allows: the owner can also stop trading and block callers.
function pause() onlyOwner whenNotPaused publicfreezestransfer,transferFromandapprove, andblackListAddress(address listAddress, bool isBlackListed) ... whenNotPaused onlyOwnersets a flag thattransferandtransferFromcheck asrequire(tokenBlacklist[msg.sender] == false);. The check is onmsg.sender, so it blocks the caller of the token function: a blacklisted router blocks sales that go through that router, a blacklisted pair blocks buys, and a blacklisted holder can no longer calltransferdirectly (a router-initiatedtransferFromof that holder's tokens is checked against the router, not the holder). - Code allows: ownership can be handed to another address with
transferOwnership(address newOwner)but there is no renounce function, andrequire(newOwner != address(0))blocks setting the owner to zero, so the mint power cannot be given up through the code. The on-chain owner read on 2026-09-30 is 0xd5881bfa…77e6ca. - What happened, per the De.Fi listing: the deployer called
mint()to create new tokens to its own wallet (0x7d4e6e05…db40dc) and sold them several times starting from 0xa23f6f33…5fd953; the listing records the loss as 187,400 USD.
Protocol details
Evidence
- report De.Fi REKT database entry for AST (proof link: VidarTheAuditor post, not openable) twitter.com
- transaction bscscan.com transaction 0x7d4e…40dc bscscan.com
- transaction bscscan.com transaction 0xa23f…d953 bscscan.com
- address ChinaCreatedCovid.sol (Astronaut NFT / AST) verified source on BscScan (local Sourcify copy) bscscan.com
- analysis Web Archive web.archive.org
- analysis Sourcify repository entry for the AST contract repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
