Coin Rug Pull

Reported loss $42K
Rugpull

What happened

COIN is an Ethereum token at 0x517ac17D…9eDA17, deployed on 5 August 2023 by 0xdd7f3e90…Bcb412, which is still its owner and also receives all tax proceeds. The owner can call blockBots to flag any address, and a flagged address can no longer send tokens, so it cannot sell; only the owner or a wallet holding at least 20% of the supply can clear a flag. The owner can also set the maximum transaction size to zero, which stops every transfer not involving the owner, and raise the sell fee to 99%.

A public function, executeTokenSwap, lets anyone emit fake Transfer and Uniswap-style Swap events that look like buys from the pool without moving any tokens. CertiK reported on 6 August 2023 a large liquidity removal, said the token appeared to be a honeypot and put the deployer's gain at about $31,000. De.Fi's REKT database lists a rug pull in which 22.65 WETH (about $42,000) was withdrawn from the Uniswap V2 pool and spread across four wallets, citing liquidity removal transaction 0x0efd9a21…7c2016.

How it happened

  1. The constructor gives the deployer the whole supply, creates the WETH pair on Uniswap V2 and exempts the deployer, which is also the hard-coded _developmentAddress and _marketingAddress, from fees.
  2. Until the owner calls activateTrading(), every transfer that does not involve the owner reverts.
  3. blockBots(address[]) is onlyOwner and sets bots[addr] = true. _transfer then runs require(!bots[from] , "TOKEN: Your account is blacklisted!"), so a flagged holder cannot sell or move tokens. unblockBot requires msg.sender == owner() || balanceOf(msg.sender) >= totalSupply() / 5.
  4. setMaxTxnAmount has no lower bound; at zero, require(amount <= _maxTxAmount, ...) fails for every transfer between non-owner addresses, while the owner's own transfers skip the check. updateFees allows a combined sell fee of up to 99%.
  5. executeTokenSwap and _Transfer are public and only emit events: emit Transfer(uniswapPool, recipients[i], tokenAmounts[i]) and emit Swap(...) with the router as sender, so explorers and trackers can show buys that never happened. No balance changes.
  6. CertiK reported a large liquidity removal with the deployer gaining about $31,000; De.Fi's listing puts the withdrawal at 22.65 WETH (about $42,000).

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract COIN

Evidence

Same attack technique

Browse all hacks →
Jigsaw saw you $160K lost Gladiator $246K lost Plankton Plankton $288K lost BitLord $566K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes