DOXED Rug Pull

Reported loss $30K
Rugpull

What happened

DOXED (DOX, BNB Smart Chain, contract 0xEDA3eB7A…CEe84e) is a reflection-fee token whose owner can flag any address as a bot, set the per-transaction limit and the trading cooldown to values that stop all non-exempt trades, and set the buy/sell tax with no cap. The automatic liquidity function sends the resulting LP tokens to owner(). On 2023-02-05 CertiK Alert reported the price down more than 99% after a wallet linked to the project, starting 0x591d..., removed liquidity and sold about $30,000 (89 BNB). De.Fi's REKT database lists the loss as $30,000.

Addresses and transactions listed by De.Fi:

How it happened

  1. The constructor creates the DOX/WBNB pair and sends the whole supply to the owner: _rOwned[owner()] = _rTotal;. It exempts the owner, the dev, marketing and giveback wallets from fees with _isExcludedFromFee[owner()] = true;. Those exempt addresses also skip the transaction limit and cooldown, which only apply when !_isExcludedFromFee[from] && !_isExcludedFromFee[to].
  2. What the code allows: setAntibot and bulkAntiBot let the owner set _isBot[account], and _transfer starts with require(!_isBot[from] && !_isBot[to], "You are a bot");. These check from and to, so a flagged holder cannot sell and a flagged pair would block every buy and sell.
  3. What the code allows: updatMaxTxAmt sets maxTxAmount = amount * 10**_decimals;, and non-exempt transfers need require(amount <= maxTxAmount, ...); a value of 0 makes every non-exempt transfer revert. updateCoolDownSettings sets coolDownTime = _timeInSeconds * 69 seconds; and each non-exempt sell or buy needs require(timePassed > coolDownTime, ...) where timePassed is measured from _lastTrade, which starts at 0, so a cooldown longer than the current Unix timestamp blocks even a first trade.
  4. What the code allows: setTaxes has no cap and checked arithmetic in _getTValues (tAmount-s.tRfi-s.tDev-...) reverts if the total exceeds 100%. updateRouterAndPair, rescueBNB and rescueAnyBEP20Tokens are owner-only, and addLiquidity passes owner() as the LP-token recipient. renounceOwnership exists. No opened transaction shows any of these setters being called.
  5. What happened, per CertiK Alert: on 2023-02-05 it reported the token down more than 99%, with a wallet linked to the project, 0x591d..., removing liquidity and selling about $30,000 (89 BNB). An on-chain read on 2026-09-30 shows the current owner as 0x591d931a…3da311, not the deployer, so ownership had moved to another address.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract DOX

Evidence

Same attack technique

Browse all hacks →
Zodiac Credit $33K lost ROT Token $116K lost China Rabbit $88K lost ETX Infinity $62K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes