Deerdefi Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

DEER (Deer Token) is a BEP20 token on BNB Smart Chain whose verified source lets the owner mint without limit. mint(address _to, uint256 _amount) is public onlyOwner and calls _mint, and the base contract adds a second owner-only mint(uint256 amount); neither has a supply cap. The token also overrides _transfer so that 1% of each normal transfer is moved to the dead address 0x000000000000000000000000000000000000dEaD.

De.Fi's REKT database lists DEER as an exit scam / rug pull dated 2021-08-26 with no loss figure and links a BscScan page for address 0xc6a6a5aa…822585; the code shows what the owner can do, not what the owner did.

How it happened

  1. The contract inherits OpenZeppelin Ownable, so the deployer 0xa7cDe8b3…A972Cb starts as owner and ownership can be moved with transferOwnership (the owner read on 2026-09-30 is 0xd92e8490…2a7d09).
  2. DeerToken.mint is function mint(address _to, uint256 _amount) public onlyOwner { _mint(_to, _amount); ... }, so the owner can create any amount of DEER for any address.
  3. _mint only runs _totalSupply = _totalSupply.add(amount); and credits the balance, with no maximum supply, so new tokens dilute all existing holders.
  4. BEP20.mint(uint256 amount) is also public onlyOwner and mints to _msgSender(), giving the owner a direct route to newly created tokens.
  5. For ordinary transfers _transfer computes burnAmount = amount.mul(1).div(100) and sends it to the dead address, then sends amount.sub(burnAmount) to the recipient, so the sender is debited exactly amount in total; this 1% fee does not block sells or change the mint power.
  6. Minted tokens could be sold into a liquidity pool, draining the paired asset. The code allows this; De.Fi lists the token as a rug pull, but no transaction showing a mint or sale was opened.

Protocol details

Classification Yield Aggregator
Protocol Type Exit Scam/Rugpull
Affected asset / contract DEER
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Polygon Glockswap Loss not disclosed BNB Chain Evilswap Loss not disclosed BNB Chain Antisocial.finance Loss not disclosed BNB Chain Ozone Finance Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes