CoinPanda_ETH Rug Pull

Reported loss $81K
Rugpull

What happened

CoinPanda (COINPANDA) is an Ethereum token deployed on 15 November 2023 at 0xBBdce1eD…34876c by 0x6923D0dC…c4c18C, whose source comments present it as a crypto tax platform. Two admin functions hide behind misleading names and answer to panadmin, an address set at deployment and separate from owner: a one-argument totalSupply(address) flags a wallet so that every transfer out of it reverts, and ksggxx() adds 77.7 billion tokens, about 86 times the 900 million supply, to the admin's balance each time it is called. Renouncing owner does not touch either power.

De.Fi's REKT database records that on 3 December 2023 33.56 WETH (about $80,554) of liquidity was removed from the Uniswap pool in transaction 0x5d7101f3…48c01c, that most of it went to Tornado Cash and the rest to another address, and that the deployer sent 1.92 ETH to the remover's address 0x4b50156e…6B70ce afterwards, in 0xaaedbd24…afc454. Cyvers reported on 9 January 2024 that the project's Twitter account and website were down, and that the deployer had swapped 233M COINPANDA with $22.5K deposited to Tornado Cash.

How it happened

  1. The constructor mints 900,000,000 COINPANDA to the deployer and stores the psadmin argument as panadmin.
  2. totalSupply(address safax), an overload of the standard view name, is callable only by panadmin and sets tallinfo[safax] = true; name(address pskk) sets it back to false.
  3. In _transfer, a flagged sender's amount is replaced with 2000 + balance, so require(balance >= amount, "ERC20: transfer amount exceeds balance") always fails. A flagged holder can neither sell to the pool nor move tokens to another wallet.
  4. ksggxx() passes its checks only for panadmin and runs _favvxx[temo3] += bfx, where bfx is 35 × 2,220,000,000 tokens. Nothing limits repeat calls, _totalSupply is not increased, and no Transfer event is emitted, so the new balance does not show up in supply trackers.
  5. With either tool, the admin can keep buyers from exiting or print tokens to sell into the pool, and whoever holds the LP tokens can withdraw the pool. De.Fi records a 33.56 WETH liquidity removal on 3 December 2023.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract COINPANDA
Protocol links Website @Coinpanda_ETH

Evidence

Same attack technique

Browse all hacks →
Abattoir of Zir $226K lost CKD TOKEN $485K lost MYX Finance $120K lost Symbiogenesis $54K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes