DecentraWorld Rug Pull

Reported loss $1.0M
Rugpull

What happened

DecentraWorld ($DEWO) was a fixed-supply BEP20 token on BNB Smart Chain with a PancakeSwap pool, a buy/sell tax, and per-wallet buy and sell limits. The contract has no mint function, but it exempts the deployer from both the tax and the sell limit and routes the DAO/farming tax to the deployer by default, so one wallet could collect a large token balance and sell it in a single swap while ordinary holders were capped at small sells.

The token was created in transaction 0xb8ff69cf…36faf7, which minted 100 million $DEWO to the creator address 0x5055e1d9…a68833. On 2022-05-24 that address sold tokens for WBNB on PancakeSwap in transaction 0x94018528…816f66. CertiK's write-up reports a sale of 31,825,441 $DEWO for about 3,128 BNB (roughly 1 million USD), a price drop of more than 97%, and the proceeds moving to 0x3b9dcfe4…039991. CertiK classifies this as a rug pull by the deployer rather than an exploit. The existing record puts the loss above 1 million USD.

How it happened

  1. The constructor mints the whole supply to the deployer: _balances[msg.sender] = _totalSupply; with _totalSupply = 100000000 * (10 ** decimals());. No later _mint exists, so the supply is fixed.
  2. The constructor makes the deployer the DAO/farming tax receiver and exempts it from tax and limits: daoandfarmingAddress = msg.sender;, excludeFromTax[msg.sender] = true;, exclueFromMaxTx[msg.sender] = true;. Tax tokens from every buy and sell therefore accumulate in the deployer wallet as well as the original supply.
  3. Ordinary holders face a per-cooldown sell cap. checkSellTxLimit requires exclueFromMaxTx[_sender] == true || txSettings.sells[_sender].add(_amount) < txSettings.sellMaxTx, and the default is txSettings.sellMaxTx = _totalSupply.div(800); (0.125% of supply, 125,000 $DEWO; the owner-only setTxSettings cannot set it below _totalSupply.div(400), 0.25%). The deployer passes the first condition, so the cap never applies to it.
  4. On a sale, _transfer skips the tax when if(excludeFromTax[to] || excludeFromTax[from]) { hasTaxes = false; }, so the deployer's sell is untaxed and unlimited in size. The owner also keeps setExcludeFromTax and setExclueFromMaxTx (both onlyOwner) and renounceOwnership was not called according to the current owner() read, which still returns the deployer.
  5. What happened, per CertiK: on 2022-05-24 the deployer sold 31,825,441 $DEWO from its initial holdings and accumulated fees for about 3,128 BNB in transaction 0x94018528…816f66, and the token price fell by more than 97%. The code alone does not show a liquidity-removal step; this was a sale into the pool.

Protocol details

Classification Gaming / Metaverse
Protocol Type Exit Scam/Rugpull
Affected asset / contract DEWO

Evidence

Same attack technique

Browse all hacks →
Magic $47K lost SHIDAO $180K lost GOAT $250K lost Hunter Global $1.2M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes