Ba5ic finance Rug Pull

Reported loss $1K
Ethereum
Rugpull

What happened

Ba5ic Finance (BASIC) is a fee-token template whose owner-only setFeeTransfer(address _feeDistributor, uint256 feeValue) is a mint in disguise. It assigns feeValue to any address's balance and adds the same amount to _totalSupply, without emitting a Transfer event. The fee settings in the template do nothing, because _transfer never calls the fee calculation.

Per Etherscan, the deployer address 0xE3344CEC…3AfC86 added 20 ETH and 40,000 BASIC to Uniswap V2 on 2020-12-02 (tx 0x789fa9d7…90cdbb), called setFeeTransfer with its own address as the recipient (tx 0xbeeb0966…1855c1), and 52 seconds later swapped 100 million BASIC for 21.76 ETH (tx 0x07f1a03e…ab94b0). De.Fi's REKT database lists the incident as an Exit Scam/Rugpull with a 1,055 USD loss.

How it happened

  1. The constructor of Ba5icFinance only sets the name and symbol, so no tokens are created at deployment. The only code that raises _totalSupply is setFeeTransfer.
  2. setFeeTransfer is ownerOnly and runs _balances[_feeDistributor] = feeValue; _totalSupply = _totalSupply.add(feeValue);. Despite its comment (transfer collected fee value to fee dristributor), it takes no tokens from anyone: it overwrites the recipient's balance with an owner-chosen number and grows the supply by the same amount. It emits no event, so explorers show no token transfer for the call.
  3. The fee machinery cannot be what the name suggests: _transfer is a plain balance move (_balances[sender] = _balances[sender].sub(amount, ...) then _balances[recipient].add(amount)) and never calls calculateAmountsAfterFee, so txFee, setFee and the feeless whitelists have no effect on transfers.
  4. On 2020-12-02 at 13:57 UTC the deployer paired 20 ETH and 40,000 BASIC in a new Uniswap V2 pool.
  5. At 14:43:03 UTC the deployer called setFeeTransfer with _feeDistributor set to its own address (Etherscan shows the call with no token transfers, consistent with the code above).
  6. At 14:43:55 UTC, 52 seconds later, it called swapExactTokensForETH on Uniswap V2 Router 2 and sold 100 million BASIC for 21.76 ETH, against 20 ETH it had put into the pool.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract BASIC
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Ethereum Waronrug degen token $555 lost Ethereum Twerk Finance $13K lost Ethereum Solv3 network $36K lost Ethereum Yearnspace $34K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes