CBC Token Rug Pull

Reported loss $113K
Rugpull

What happened

CBC Token (CBC) is a BNB Chain token deployed on 21 March 2023 at 0x9E10Cf57…AF4804 and paired with USDT on PancakeSwap. For the first 18 hours after its pool was funded, the code sends 100% of every buy and every sale to the burn address unless the owner turns on openBuy or openSell, and caps each wallet's buys at 500 CBC; after that, the owner can raise two of its three fees with no upper limit, which can take a whole trade or make every taxed trade revert. Liquidity removals are exempt from all fees.

On 6 April 2023 CertiK reported that EOA 0x5d2cb0f4…ea7e7e removed about $113K from the CBC pool, profiting about $81K. De.Fi's REKT database lists this as an exit scam/rug pull and says the EOA had received CBC from the project's deployer twenty days earlier, then moved the funds to another address (liquidity removal tx 0x03f9d3b8…f87ed4).

How it happened

  1. The constructor creates the CBC/USDT PancakeSwap pair, mints 12,500,000 CBC to the deployer and excludes the owner and the contract from fees.
  2. The first transfer into the pair sets createPairTime. For the next 18 hours every taxed buy runs if (openBuy){ BurnFee=amount.mul(20).div(100); }else{ BurnFee=amount.mul(100).div(100); } and checks require(buylimit[to].add(amount)<=500*10**18,"transaction amount exceeded"); every taxed sale runs the same pattern with openSell (5% if open, 100% if not). The sender is debited the full amount and the recipient gets amount.sub(NftDividendsFee).sub(LPFee).sub(BurnFee), so a 100% fee sends everything to 0xdead. setOpenBuy and setOpenSell are owner-only.
  3. After 18 hours the fees are _burnFee 15, _LPFee 20 and _nftDividendsFee 15 per thousand. setLPFeePercent and setNftDividendsFeePercent accept any value. If the three fees reach 1,000 per thousand a buy or sale delivers nothing; above that the SafeMath sub reverts, so every taxed buy and sale fails. excludeFromFee and includeInFee let the owner choose who pays.
  4. _isLiquidity marks transfers that add to or remove from the pool, and isAddLiquidity||isDelLiquidity sets takeFee=false, so a liquidity provider can always withdraw without fees.
  5. On 6 April 2023 EOA 0x5d2cb0f4…ea7e7e removed about $113K of liquidity from the pool, profiting about $81K, according to CertiK.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract CBC

Evidence

Same attack technique

Browse all hacks →
Zodiac Credit $77K lost PCORE $40K lost TRT $93K lost OBB $96K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes