Boost Coin Rug Pull

Reported loss $593K
Rugpull

What happened

Boost Coin (BOOST) was an Ethereum token deployed on 5 September 2023 at 0x302cae5d…b33218 by 0x413217Ac…6552eA. Its contract charged a tax on every sell, swapped the taxed tokens for ETH and kept that ETH inside the token contract, where an owner-only withdrawETH function could send the whole balance to the owner. On 6 September 2023 the deployer called withdrawETH and received 363.44 ETH, about 593,267 USD.

The owner could also switch trading off, blacklist any address and set the sell tax as high as 100%. Cyvers flagged the transaction as a rug pull and reported that 62 ETH of the proceeds went to FixedFloat and the rest was spread across other addresses.

How it happened

  1. The constructor gives the deployer the whole supply and makes it fee-exempt: exemptFee[msg.sender] = true; and _mint(msg.sender, totalSupply_);.
  2. Every sell pays a tax set by sellTaxRate(), which steps down in 30-minute bands after trading is first enabled: 30%, 25%, 20%, 15%, 10% and 5% over the first 180 minutes, then the owner-set sellTaxRateBasisPoint. The taxed tokens go to the token contract, and once they pass maxSellTaxLimit the contract calls swapTokensForETH, which sells them on the Uniswap V2 router with the ETH sent to address(this).
  3. withdrawETH() is onlyOwner and sends the contract's entire ETH balance to the owner: owner().call{value: address(this).balance}(""). The ETH collected from holders' sell taxes therefore belongs to the owner in practice.
  4. The owner can also trap holders directly: setIsTradingEnabled(false) makes every transfer by a non-exempt address revert with "Trading is currently disabled.", setBlacklist blocks any address as sender or recipient in _beforeTokenTransfer, and setSellTaxRateBasisPoint accepts any value up to MAX_BASIS_POINT (10,000, i.e. 100%). withdrawTokens() lets the owner take the contract's token balance, including buyers' unclaimed tax refunds, once the 18-day claim window closes.
  5. On 6 September 2023 at 03:04 UTC the deployer called withdrawETH() (0x68ee5c57…43d991) and received 363.44 ETH from the token contract. Most of the contract's ETH inflows before that came from the Uniswap V2 router on 5 and 6 September, which fits the sell-tax swaps.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract Boost
Protocol links Website @RoostCurrency

Evidence

Same attack technique

Browse all hacks →
Friendchips.tech $39K lost Helio Protocol $178K lost EspressoBot $53K lost Genswap $62K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes