Beamsplittr Rug Pull

What happened

Beamsplittr (BSPLT) is an Ethereum token whose contract gives the admin address a function, collectTaxDistribution, that mints any quantity of new tokens and sells them into the Uniswap pool for ETH, with no cap and no timelock. CertiK Skynet reported that the deployer called this method to mint 9.99e12 BSPLT, about ten times the original 1e12 supply, and swap them for roughly 32 ETH (about $60K), dropping the price by around 75%. De.Fi's REKT database lists the loss as 60,824 USD and lists the proceeds as moved to another EOA and then deposited into the Incognito protocol.

Scammer address (as listed by De.Fi): 0x1BA8ff40…EC3533.

How it happened

1. The constructor mints the whole initial supply to the token contract itself, _mint(address(this), 1_000_000_000_000000);, and openTrading() pairs it with the contract's ETH through addLiquidityETH(..., admin, block.timestamp). The Uniswap LP tokens are sent to admin, the deployer; nothing in the contract locks them.
2. collectTaxDistribution(uint256 tokenAmount) is onlyOwner and has no limit on tokenAmount. It runs _mint(address(this), tokenAmount);, sets allowance[address(this)][address(uniswapV2Router)] = tokenAmount;, then calls swapExactTokensForETHSupportingFeeOnTransferTokens(tokenAmount, 0, path, team, block.timestamp). The ETH goes to team, which is set to the deployer in the constructor, and the amount-out minimum is 0.
3. The sale goes through transferFrom with from == address(this), which transferFrom exempts from the sell tax (from != address(this)). The minted tokens enter the pair as new supply while the pair pays out its ETH.
4. Other controls sit in the same contract. setTax has no cap (a sellTaxPct above 100 makes amount - fee revert, so sells fail), setLimits can set maxSellAmount to a tiny value so sells revert with Sell Limit Exceeded, and enforceLimits lets team either set disableBot[holder] (blocking that holder's transfers) or _burn a percentage of any holder's balance.
5. The ownership controls are not final. renounceOwnership() sets admin = address(0), but emergencyStop(address input) is public with no access check: if(input == address(this)) admin = _getStopActions(); returns the admin role to team for anyone who calls it. The emergencyStatus modifier also checks team, not admin.
6. What happened, per CertiK Skynet: the deployer called collectTaxDistribution() to mint 9.99e12 tokens and swap them for about 32 ETH (about $60K), with the price down about 75%. De.Fi's REKT database lists a liquidity-draining transaction 0xe637b595…17e633, a later deposit of the proceeds into the Incognito protocol in transaction 0xfb1405c2…f17494, and a loss of 60,824 USD. Those transactions were not opened for this draft.

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract BSPLT

Evidence

• report @CertiKAlert incident report twitter.com
• report CertiK Alert tweet on Beamsplittr twitter.com
• transaction etherscan.io transaction 0xe637…e633 etherscan.io
• transaction etherscan.io transaction 0xfb14…7494 etherscan.io
• address Beamsplittr Token verified source on Etherscan etherscan.io
• address etherscan.io address 0x1BA8…3533 etherscan.io
• analysis Beamsplittr Token on Sourcify repository (exact match) repo.sourcify.dev