What happened
Delicacy DeFi's DELI token is a BEP20 with governance voting that mints 1,000 DELI to the deployer in its constructor and keeps an onlyOwner mint(uint256 amount) function with no cap, so the owner address can create more supply at any time. The source has no sell block, blacklist or fee logic. De.Fi's REKT database lists the project as an exit scam/rug pull with a loss of 3,725 USD, and describes the deployer adding liquidity, locking the bigger part of the LP tokens with CryptEx, and removing the liquidity after the unlock. A RugDoc post linked by De.Fi says the team's code contained a suspicious lpToken.Update(address(_owner), uint(-1)) call and that the admin called it leftover test code; that line is not in the DELI token contract itself.
The contract deployer added initial liquidity at: Tx 1 0x6a2a…92f4 Tx 2 0x0256…2cb1
The contract deployer locked the bigger part of LP tokens using CryptEx at: Tx 0x5655…dcbb
After the unlock, the liquidity was removed by the contract deployer at: Tx 0xfe69…2b51
How it happened
- The constructor mints the initial supply to the deployer:
_mint(msg.sender, 1000000000000000000000);(1,000 DELI). - The
BEP20base contract exposesfunction mint(uint256 amount) public onlyOwner returns (bool) { _mint(_msgSender(), amount); return true; }. It has no cap or timelock, so whoever is the owner can mint any amount to themselves and sell it into the DELI pool. No transaction was opened showing a mint after launch. - Ownership can be handed on with
transferOwnership(address newOwner). The current on-chain owner (read 2026-09-30) is 0x5c874142…749759, which differs from the deployer 0x0d85A1B9…FB67DE; the source does not say when or why ownership moved. - According to De.Fi's REKT database, the deployer added liquidity, locked the larger share of the LP tokens with CryptEx, and removed the liquidity after the lock expired (transactions listed above). The liquidity removal could not be opened on BscScan (HTTP 403), so it is reported as De.Fi's listing.
Protocol details
Evidence
- transaction bscscan.com transaction 0x0256…2cb1 bscscan.com
- transaction bscscan.com transaction 0x5655…dcbb bscscan.com
- transaction bscscan.com transaction 0x6a2a…92f4 bscscan.com
- transaction bscscan.com transaction 0xfe69…2b51 bscscan.com
- address BscScan verified source, DeliToken 0x66b32cee882d82a897a1f6102a18da5af6f01f6f bscscan.com
- analysis De.Fi REKT database listing for DELI (listing data supplied with the input) t.me
- analysis Web Archive web.archive.org
- analysis Sourcify repository, DeliToken repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
