What happened
Bio Farm's BIO token is an ERC20 (BioToken, whose verified source is headed BioToken with Governance) with governance checkpoints. Its mint function can create any amount of new BIO for any address, restricted only to the contract owner, so the supply is not capped by the code. A tweet posted on 2021-01-13 flagged the token as a scam in which tokens were dumped from several wallets, and De.Fi's REKT database lists the project as an exit scam / rug pull with a loss of about 73,244 USD.
De.Fi's listing records this sequence: the deployer added initial liquidity (tx 0xb3796704…200ff0), sent minted tokens to an external address (tx 0xbdae09f0…d7d3c9), that address added liquidity with the tokens (tx 0x507d8fcc…52aef6), and the liquidity was then removed by the external address (tx 0x53141b88…080f7c) and by the deployer as well (tx 0x279a1fbb…df2912).
How it happened
- The contract defines
function mint(address _to, uint256 _amount) public onlyOwner { _mint(_to, _amount); ... }. The only gate isonlyOwner, and there is no supply cap or minting limit anywhere in the contract. - The deployer is the first owner (
Ownablesets_owner = msgSenderin the constructor), andtransferOwnershiplets the owner hand the role to another address. The owner address read on-chain on 2026-09-30 is 0xf3502718…3fbeb0, which differs from the deployer 0xD46e3be4…761A12. This is a current-state read, not a record of when or how ownership moved. - Per De.Fi's REKT database, the deployer sent minted tokens to an external address, which added liquidity with them; both the external address and the deployer later removed liquidity (transactions in the description). The contract itself has no sell block or trading switch:
_transferis the plain OpenZeppelin version, so the extraction ran through ordinary liquidity-pool trades and liquidity removal. - The 2021-01-13 tweet at the seed link says the owner dumped tokens using different wallets and that the rug happened as the tweet was written. De.Fi's listing puts the loss at 73,244 USD. Which addresses finally held the proceeds is not established by the sources opened here.
Protocol details
Evidence
- report Tweet on Bio Farm / $BIO scam, 2021-01-13 (De.Fi proof link) twitter.com
- transaction etherscan.io transaction 0x279a…2912 etherscan.io
- transaction etherscan.io transaction 0x507d…aef6 etherscan.io
- transaction etherscan.io transaction 0x5314…0f7c etherscan.io
- transaction etherscan.io transaction 0xb379…0ff0 etherscan.io
- transaction etherscan.io transaction 0xbdae…d3c9 etherscan.io
- address Etherscan verified source, BioToken 0xae8f1356ec073accdd4bf5914d37a44dfd954a0d etherscan.io
- analysis Sourcify repository entry for the same contract repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
