China Rabbit Rug Pull

Reported loss $88K
Rugpull

What happened

ChinaRabbit (ChinaRabbit, BSC contract 0x5116737A…B20630) is a BEP20 token whose source gives the deployer a hidden balance-editing function. setAutomatedMarketMakerPair(pair, value) reads like a routine pair-registration setter, but it adds value to _balances[pair] without debiting anyone or raising the total supply, and it is gated by a private _Msgsender variable that stays set to the deployer even after renounceOwnership(). The token also burns 2% of every transfer.

CertiK's alert of 2023-01-15 reports a slippage event in which the token dropped more than 95% and the deployer (0x914b...) sold about $88K. De.Fi's REKT database lists the incident as an exit scam/rug pull of about $88K, says the deployer removed liquidity from the pair and sold a large quantity of tokens, and puts the price drop at roughly 90%.

Block data

from De.Fi's listing: deployer 0x914b9044…061d88; example sale transaction 0x40740941…283e4a.

How it happened

  1. The constructor mints the whole 1,300,000,000 supply to the deployer (_mint(msg.sender, 1300000000*1e18);). Ownable also stores the deployer in a second private variable (_Msgsender = msgSender;).
  2. Every transfer burns 2%: uint256 burnamount = amount.mul(2).div(100);. The sender is debited the full amount (_balances[sender] = _balances[sender].sub(amount, ...)), the recipient is credited amount minus the burn, and the burned part is added to _balances[address(0)] while _totalSupply shrinks. The team fee line is amount.mul(0).div(100), so it is zero.
  3. The balance-editing function is setAutomatedMarketMakerPair(address pair, uint256 value) public onlyMsg. It calls _setAutomatedMarketMakerPair, which runs _balances[pair] = _balances[pair].add(value);. Nothing is subtracted from any account, _totalSupply is untouched and no Transfer event is emitted.
  4. What this allows: the deployer can credit a liquidity pair with any number of tokens. A Uniswap V2-style pair works out how many tokens were paid in by comparing balanceOf(pair) with its stored reserves, so phantom tokens can be counted as payment for BNB taken out of the pool.
  5. Renouncing does not remove the power. onlyMsg checks _Msgsender == _msgSender(), and renounceOwnership() only clears _owner. An owner() read of the zero address (eth_call, 2026-09-30) therefore does not mean the setter is dead.
  6. What was reported: CertiK says the deployer sold about $88K of the token and the price fell more than 95%. Neither the alert nor the code evidence shows whether the sale used the deployer's own tokens or the setter, and no transaction showing a call to setAutomatedMarketMakerPair was opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ChinaRabbit

Evidence

Same attack technique

Browse all hacks →
ROT Token $116K lost DOXED $30K lost ETX Infinity $62K lost SSPF $126K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes