Boost Rug Pull

Reported loss $23K
Ethereum
Rugpull

What happened

BOOST was a reflection token deployed on Ethereum on 13 December 2020 at 0x65D14e3E…A5dD34 by 0xaDa95481…0D3DEE, and sold first through a BoostCrowdsale contract (0xb7e6db68…467703). The token charges a 2% transfer fee redistributed to holders, but its owner can lower feeDivisor to 1, which turns the fee into 100% of every transfer that does not involve a feeless address; admins can also make any address feeless. The code also lets admins withdraw the LP tokens the contract itself holds after 90 days.

The deployer did not need either power: on 19 December 2020 it locked its 509.74 LP tokens in the Rainicorn vesting contract, withdrew them on 26 December and removed the liquidity 7 minutes later, receiving 17.42 ETH and about 16,689 BOOST. According to the live record the crowdsale raised 35.46 ETH, of which 17.2 ETH became initial liquidity. De.Fi's REKT database lists this as an exit scam with a loss of 22,680 USD.

How it happened

  1. The token is an RFI-style reflection token. _getTValues takes tFee = tAmount.div(feeDivisor) from each transfer and redistributes it to holders; feeDivisor starts at 50, a 2% fee.
  2. setFeeDivisor(uint256 divisor) is onlyOwner and only requires divisor > 0. At 1 the fee equals the whole amount, so the sender is debited in full and the recipient, including the Uniswap pair on a sale, receives nothing. Addresses marked in _isFeeless skip the fee; the deployer is feeless from the constructor, and toggleFeeless lets a whitelist admin add others.
  3. A presale lock in _transfer reverts transfers while locked is true, but the constructor sets locked = false and the only setter, unlock(), can only clear it, so it cannot be turned back on.
  4. unlockLP() lets a whitelist admin take every LP token held by the token contract once lpUnlocked (deployment plus 90 days) has passed. The deployer's own LP tokens were outside this contract.
  5. What happened on-chain: on 19 December 2020 the deployer called lockTokens on the Rainicorn vesting contract with 509.74 UNI-V2 LP tokens (0xfab8aaca…3d4706). On 26 December 2020 at 00:46:06 UTC it called withdrawTokens and got them back (0x90fe5580…23af90), and at 00:53:04 UTC it called removeLiquidityETHWithPermitSupportingFeeOnTransferTokens, burning the 509.74 LP tokens for 17.42 ETH and about 16,689 BOOST (0xa1b3a005…20e2f6).
  6. According to the live record, the 35.46 ETH raised was moved to a proxy contract (0xee145c44…786efc, 0x7e8e6bc3…75bb55), 17.2 ETH of initial liquidity was added through that proxy (0x095fc653…aac606), the deployer added liquidity itself (0x49137d8b…4aad70) and received LP tokens from the proxy (0x5075c55e…a36d55).

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract BOOST

Evidence

Same attack technique

Browse all hacks →
Ethereum Slicer Finance $14K lost Ethereum GrowBase Finance $4K lost Ethereum Rapid Set Dollar $48K lost Ethereum Metropolis.finance $8K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes