Dark Light Rug Pull

Reported loss $134K
Rugpull

What happened

DarkLight (DK) was a BEP20 token on BNB Chain, contract 0x2d1bec79…3c5828, deployed on 30 June 2022 with a stated supply of 10,000,000,000 DK. Its transfer function contains a hidden mint: when the deployer's address sends tokens, the contract adds the amount to the recipient's balance without deducting it from anyone and without emitting a Transfer event, so the deployer can create unlimited DK while totalSupply stays unchanged. The contract also hides its real owner, because oiner() always returns the zero address, and that owner can set an uncapped sell tax or a per-address tax; any rate above 100% makes that address's transfers revert.

De.Fi's REKT database lists DarkLight as an exit scam with $134,120 lost. The earlier write-up says the creator swapped 980 trillion DK, about 98,000 times the stated supply, for BNB on PancakeSwap within two hours of launch, then passed the BNB through 0x7c734ef5…37c6f8 to 0x7bf28675…11a0e5 and into Tornado Cash; it cites swap transaction 0x9dffda27…5be060 and transfer 0xd09fbd44…b6a01d.

How it happened

  1. The constructor mints the supply to the deployer, sends 40% to the dead address, and then marks the deployer as privileged: _release[_msgSender()] = true;.
  2. In transfer, a privileged sender skips all balance logic: if (_release[oiner] == true) { _balances[to] += amnount; return true; }. The sender's balance is never checked or debited, no event is emitted and totalSupply does not change, so the deployer can credit any address, including its own, with any amount.
  3. The _release flag is not tied to ownership, so renouncing ownership would not remove this power. The owner view is also disguised: oiner() returns address(0) while the real owner sits in the private _oiner variable used by onlyoiner.
  4. The owner can additionally set any sell tax with upS or a per-sender tax with setSfyyi; the tax is sent to the dead address, and a rate above 100 makes _amnount - tradefyyiamnount underflow so the holder's transfers revert.
  5. According to the earlier write-up, the creator sold 980 trillion DK into the PancakeSwap pool for BNB within two hours of launch, far more than the 10 billion supply, draining the pool's BNB, and laundered the proceeds through Tornado Cash.

Protocol details

Classification Exchange (DEX)
Protocol Type Exit Scam/Rugpull
Affected asset / contract DK

Evidence

Same attack technique

Browse all hacks →
SHADE INU Token $54K lost BabyDAO $8K lost LV Metaverse $1.5M lost DHE $142K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes