Carillonium Rug Pull

Reported loss $59K
Rugpull

What happened

Carillonium finance (CAROM) is a BNB Smart Chain token built from a generic token-generator template. Its constructor mints the whole supply of 10^15 tokens to the deploying address, which it also exempts from tax, and the owner can set uncapped buy and sell taxes, pause every transfer, and blacklist addresses. De.Fi's REKT database lists the token as rug-pulled by its creator, who is said to have previously created the NeotericFinance rug pull: after the pair was funded, the creator removed part of the liquidity, swapped, then removed the rest, for a profit of 213.27 BNB (about 59,172 USD in the listing).

Scammer address: 0x8f0d9acb…2387e4.

How it happened

  1. The constructor mints the full supply to its caller: initialSupply =_supply * (10**18); ... _mint(msg.sender, initialSupply);, and creates the PancakeSwap pair itself with uniswapV2Factory.createPair(address(this), uniswapV2Router02.WETH()). The on-chain total supply is 10^15 tokens. exclude(msg.sender) can only succeed in the constructor if the caller is also the owner named by _setOwner(_addr[5]), so the owner and the holder of the whole supply start as the same address.
  2. exclude(msg.sender) puts that address in excludeList. handleTax only taxes a transfer when !isExcluded(from) && !isExcluded(to), so the deployer's own sales and transfers carry no tax.
  3. Holders face owner-set terms. setSellTax and setBuyTax take any values with no upper bound (a total above 100 makes amount -= tax revert, so sells fail; a total near 100 sends nearly the whole sale to the token contract). pause() makes _transfer revert with CoinToken: token transfer while paused for everyone. enableBlacklist(address) is checked as require(!isBlacklisted(msg.sender)), require(!isBlacklisted(recipient)) and require(!isBlacklisted(tx.origin)), so listing a holder's wallet blocks every transaction it originates, while listing the router or the pair would block sells or all trading.
  4. The token code contains no liquidity lock and no function that removes pool liquidity; whoever holds the LP tokens can remove it through the router. What happened, per De.Fi's REKT database: the creator minted the supply to its own address, provided the CAROM/WBNB liquidity, and after a short time removed some of it, swapped, then removed the rest, profiting 213.27 BNB. The listing cites dumping transaction 0xf56fd7fe…92a969 and liquidity transaction 0xd9c9e6a3…4d6272. Those transactions were not opened for this draft, and the code does not show whether any owner function was used.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract CAROM

Evidence

Same attack technique

Browse all hacks →
Cornerchain $51K lost Meta Magic Coin $62K lost Marvel Metauniverse $94K lost GMT $12K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes