Dipex Rug Pull

Reported loss $17K
Ethereum
Rugpull

What happened

DIPEX (DPX) is an Ethereum token deployed on 31 December 2020 at 0xbce67604…c73e14 by 0xbed03cf8…1acb0b. Its transfer code only lets tokens move from the owner, from one owner-chosen tradeAddress, or from wallets the owner has whitelisted; every other holder's transfer and sale fails, because the sale-limit values it checks are all zero and the contract has no function to set them. The owner-only approveAndCall does not approve anything: it overwrites a chosen wallet's balance with any amount, without changing totalSupply, and whitelists that wallet to sell.

De.Fi's REKT database says the deployer added the initial liquidity (0x0277b502…b74edc) and locked it (0x6eead116…365254). On 9 January 2021 the deployer called approveAndCall for 0x658c862c…75e414 (0x5b6f330b…2462ff), and twelve minutes later that wallet sold DPX into the Uniswap pool for about 23.30 ETH (0x954e5fbc…e0b4d4). Locking the LP tokens did not protect buyers, because the pool's ETH could be drained by selling tokens created this way.

How it happened

  1. The constructor mints the whole supply to the deployer and stores it as the private owner; the contract has no function to change or renounce owner.
  2. transferFrom (which transfer also uses) calls ensure, which passes only if _from == owner || _to == owner || _from == tradeAddress || canSale[_from]; otherwise it requires condition(_from, _value).
  3. condition starts with if(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The three values are private, default to zero and are never set anywhere, so every ordinary holder's transfer or sale reverts. Holders can only send tokens to the owner.
  4. transferownership(address addr) does not transfer ownership; it sets tradeAddress, the one extra address (such as the pair) allowed to send tokens freely, which is what lets buys go through.
  5. approveAndCall(spender, addedValue) is owner-only and runs balanceOf[spender] = addedValue*(10**uint256(decimals)) and canSale[spender]=true, so the owner can give any wallet an arbitrary balance that totalSupply does not show, and let that wallet sell.
  6. On 9 January 2021 at 22:56 UTC the deployer called approveAndCall for 0x658c862c…75e414; at 23:08 UTC that wallet swapped DPX for about 23.30 ETH through the Uniswap router, taking ETH out of the pool that holders could not sell into.

Protocol details

Classification Exchange (DEX)
Protocol Type Exit Scam/Rugpull
Affected asset / contract DPX
Protocol links Website @DIPEXdex

Evidence

Same attack technique

Browse all hacks →
Ethereum Jointventure Finance $4K lost BNB Chain MinterPro $34K lost Ethereum Ultimate Set Dollar Loss not disclosed Ethereum Slicer Finance $14K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes