BJS Rug Pull

Reported loss $290K
Rugpull

What happened

BJS (BJS) is a BEP-20 token on BNB Chain at 0x17c8dd4A…D35c1C, deployed on 14 October 2022 at 18:27 UTC by 0x4BEd9927…73740e with a BJS/USDT PancakeSwap pair. On 13 July 2023 CertiK reported that about $290K in BSC-USD was removed from the BJS liquidity pool by an externally owned account; De.Fi's REKT database lists it as an exit scam/rug pull with $290k reported lost. The token has no blacklist or post-launch mint and its trade fee is fixed at 10%, but the owner can halt trading indirectly: the four fee-wallet setters accept the zero address, and every fee slice is sent through a transfer that reverts on a zero recipient.

No opened source shows the owner used this; the reported loss came from liquidity being pulled out of the pool.

How it happened

  1. The constructor creates the BJS/USDT pair and mints the whole 100,000,000,000 BJS supply to the owner.
  2. Every trade with uniswapV2Pair by a non-exempt wallet pays a fixed 10% fee inside _transfer: buys send 6%, 2% and 2% to inviteRewardAddress, nodeRewardAddress and pledgeRewardAddress, and sells send 1% to the dead address and 9% to officialRewardAddress. Each slice goes through super._transfer, which runs require(recipient != address(0), "ERC20: transfer to the zero address").
  3. The owner can call setOfficialRewardAddress, setInviteRewardAddress, setNodeRewardAddress or setPledgeRewardAddress with no zero-address check. Setting officialRewardAddress to the zero address would make every non-exempt sell revert; setting any of the three buy-side wallets to zero would make every non-exempt buy revert. Wallets marked with excludeFromFees (the owner, the contract and the router at deployment) skip the fee path and could still trade. No opened source shows these setters were called.
  4. Liquidity sits in the PancakeSwap pair, and whoever holds its LP tokens can withdraw the USDT side.
  5. On 13 July 2023 CertiK detected a large liquidity removal on BJS: about $290K BSC-USD was taken out of the pool by an EOA starting 0x0e509.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract BJS

Evidence

Same attack technique

Browse all hacks →
PAULY $224K lost Agent Smith $227K lost AI C-3PO $150K lost Jar Jar Binks $145K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes