DESTINY Protocol Rug Pull

Reported loss $121K
Rugpull

What happened

CertiK's Skynet alert of 24 March 2023 reported that about $120.8K BUSD was removed from the DESTINY Protocol (DESTINY) pool on BNB Chain by the deployer. De.Fi's REKT database lists the incident as an exit scam/rug pull and describes the deployer removing liquidity from the pair contract and selling a large quantity of tokens, with the price falling by about 90%. The deployer address is 0xa580dd85…4669c6 and De.Fi's example liquidity-removal transaction is 0x244e9f71…467bcc.

The token contract 0x673246c7…c255b6 also gives its owner standing powers over holders: a per-address blacklist that blocks transfers out of an address, buy and sell fee setters with no cap, a sell-size limit that can be set to zero, and a switch that freezes transfers for every non-exempt address. The verified source shows these powers exist but does not show that any of them was used.

How it happened

  1. The constructor gives the whole supply to the deployer and exempts it from fees: _rOwned[_msgSender()] = _rTotal; and _isExcludedFromFee[owner()] = true;. The marketing, development, charity and vault addresses are all hard-coded to the same deployer address, for example address payable public marketingAddress = payable(0xa580dD854E89CE6bF16d23C7858ddf0e7f4669C6);, and swapTokens sends the BNB from swapped fees to the charity, development and marketing addresses.
  2. What the code allows against holders (no transaction shows these being called): addToAirdrop adds any address except the owner to a blacklist, and _transfer starts with require(!_isBlacklist[from], "BEP20: transfer from blacklisted address");. Because the check is on from, a blacklisted holder cannot sell through the router (the router moves their tokens with transferFrom), and a blacklisted pair address would block every buy.
  3. setSellFee(uint256 sellTaxFee, uint256 sellVaultFee, uint256 sellLiquidityFee) and setBuyFee have no upper bound. The recipient receives tAmount.sub(tFee).sub(tLiquidity).sub(tVault), while the seller's balance is debited the full rAmount, so a combined sell fee of 100% leaves the seller with nothing and a higher one makes the sale revert.
  4. setSellMaxTxAmount(uint256 sMaxTxAmount) can be set to 0, after which require(amount <= _sMaxTxAmount, "Transfer amount exceeds the max sell amount."); fails for every non-exempt seller. setTradingOpen(false) is worse: the check require( _isExcludedFromFee[to] || _isExcludedFromFee[from], "trading paused temporarily."); sits inside a branch that already requires both to be non-exempt, so it always reverts. The owner can give these powers up with renounceOwnership, but a latest-block read of the contract on 2026-09-30 still returned the deployer as owner.
  5. What was reported: CertiK's alert says about $120.8K BUSD was removed by the deployer on 24 March 2023, and De.Fi describes the deployer removing liquidity from the pair and selling a large quantity of tokens, dropping the price about 90%. Removing liquidity is not a function of the token contract; it needs the liquidity-pool tokens held by the deployer, and the verified source does not show who held them.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract DESTINY

Evidence

Same attack technique

Browse all hacks →
Finance $81K lost EDAO $39K lost EC token $44K lost Project culs $278K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes