Creso Rug Pull

Reported loss $154K
Rugpull

What happened

Creso (CRE) is a BNB Chain token deployed on 23 November 2023 at 0x1300E870…0a2ee7 by 0xF0F26195…bCC606. The token contract keeps no balances: balanceOf and every transfer are forwarded to a private accounting contract that only the owner could set, so that unpublished contract decides who can sell and how many tokens any wallet holds, while the token still emits normal-looking Transfer events. The declared supply is 1,000,000 CRE, yet PeckShield reported that the deployer swapped 100,100,100,100,100,100,100.1001 CRE for 988.63 WBNB (about $233.7K) and the price dropped 100%.

De.Fi's REKT database lists CRE as an exit scam/rug pull in which the deployer removed 640.73 WBNB (153,603 USD) of liquidity from the PancakeSwap pool (tx 0x0ee1cb2c…da4c02, after the liquidity add in tx 0x775977be…8b2255) and moved the funds to another address, which spread them across several wallets.

How it happened

  1. The constructor sets _totalSupply = 1000000 * 10 ** 9 and emits Transfer(address(0), msg.sender, _totalSupply) but writes no balance. The contract has no balance mapping at all.
  2. balanceOf returns Accounting(accounting).balanceOf(who), and setAccountingAddress(address accountingAddress) lets the owner point accounting at any contract. The address is private and its code is not part of the verified source.
  3. transfer emits Transfer(msg.sender, to, amount) and then returns Accounting(accounting).doTransfer(msg.sender, msg.sender, to, amount); transferFrom does the same with the caller passed as the first argument. The external contract therefore sees the caller (for a sale, the PancakeSwap router), the sender and the recipient, and can refuse, alter or approve each move, or report any balance for any wallet, with no link to the declared 1,000,000 supply.
  4. renounceOwnership() sets owner to the zero address, which the chain shows today. That only stops the accounting address from being changed; the logic inside the accounting contract keeps running.
  5. PeckShield reported that the deployer sold 100,100,100,100,100,100,100.1001 CRE, about 10^14 times the declared supply, for 988.63 WBNB. Only a balance reported by the external ledger could cover that amount.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract CRE

Evidence

Same attack technique

Browse all hacks →
PAPABEAR $121K lost RepubliK $121K lost Web $179K lost DarkProtocol $174K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes