DollarDoge Rug Pull

Reported loss $194K
Rugpull

What happened

DollarDoge (DollarDoge) is a BNB Chain token with a 10% buy and sell fee (5% dividends, 5% marketing) and a holding cap, and its verified source mints the entire 100 billion supply to the deployer in the constructor. De.Fi's REKT database lists it as an exit scam / rug pull dated 2022-02-21 with 193,703 USD lost. The listing says the deployer minted and sold tokens (transaction 0xcce6ee77…c2e1cf), the proceeds were moved to an external address (transaction 0x8ede198c…071d3f), and that address deposited funds into Tornado Cash (address 0x0a014905…d13233).

PeckShield Alert posted that the deployer had dumped the token and deposited 513 BNB to Tornado Cash, and asked whether this was a rug pull or a compromised key. The deployer is excluded from both the fee and the holding cap, while the owner can change the fee without a limit and the cap without a limit.

How it happened

  1. The constructor creates the whole supply for the deployer: _mint(owner(), 10**11 * (10**decimals()));, and the comment beside it says _mint cannot be called again. The only other _mint calls are in the dividend tracker's own accounting token.
  2. The deployer is exempt from the limits that bind every other holder: excludeFromFees(owner(), true); and _isExcludedFromMaxHoldLimit[owner()] = true;. Other recipients must satisfy require(balanceOf(to).add(amount) <= maxHoldingAmount, "Holding limit!");, with maxHoldingAmount = totalSupply().div(1000);, and non-excluded transfers pay uint256 fees = amount.mul(dividendFee.add(marketingFee)).div(100);.
  3. The owner can change the terms with no ceiling: function setFees(uint256 _DividendFee, uint256 _MarketingFee) external onlyOwner and function setMaxHoldingAmount(uint256 amount) external onlyOwner. A combined fee at or near 100 leaves buyers and sellers with little or nothing, and above 100 makes amount.sub(fees) revert for every non-excluded transfer. A holding cap set to a small value makes buys into non-excluded wallets revert, while the pair is exempt from the cap. excludeFromFees and excludeFromMaxHoldLimit let the owner exempt any address.
  4. The owner can also move assets held by the contract: function withdrawStuckTokens(address _token, uint256 _amount) public onlyOwner { IERC20(_token).transfer(msg.sender, _amount); }, withdrawInDividend does the same from the dividend tracker, and setMarketWallet redirects the marketing share of fee BNB. renounceOwnership() exists, so these powers can be given up.
  5. What was reported: De.Fi's listing says the deployer minted and sold tokens, moved the proceeds to an external address, and that address deposited funds into Tornado Cash. PeckShield Alert says the deployer dumped the token and deposited 513 BNB to Tornado Cash. Which owner functions, if any, were called was not established, and nothing in the source blocks selling by an ordinary holder.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract DollarDoge
Protocol links Website @dollardogebsc

Evidence

Same attack technique

Browse all hacks →
Peace doge X $18K lost Web3Memes $28K lost Raptor2 $84K lost Mercenary $760K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes