Dragoma Rug Pull

Reported loss $3.5M
Polygon
Drain Vaults

What happened

Dragoma (DMA) was a Polygon play-to-earn game token, deployed on 9 June 2022 at 0x16dfb898…450f94, whose constructor sent 90% of the 42,000,000 DMA supply to a protocol contract, 0xCec6540b…cb3929, with unverified source code. The token also asks that contract, on every transfer, which holders are fee-exempt and how much of each holder's balance is locked as an airdrop portion, so the team's unverified contract decides who can move tokens. On 7 August 2022 at 21:16 UTC, 0x4c0ce1c7…db595d, named as the token's operation wallet at deployment, sold 50,000 DMA for about 42,028 USDT on QuickSwap.

About 90 minutes later the deployer called transferToken on the vault to send 38,000,000 DMA to that same wallet; De.Fi's listing says the wallet then drained the pools. PeckShield flagged a $3.5M rug pull with funds apparently deposited to centralized exchanges. CoinDesk reported that DMA fell 99.7%, gave its peak price separately as $1.78, and said the website went down and the project's social media channel was deleted.

How it happened

  1. The constructor mints supply * 90 / 100 (37,800,000 DMA) to protocol and stores it as protocolContract; the deploy arguments name 0xCec6540b…cb3929 as protocol and 0x4c0CE1c7…DB595D as operation, which receives 7%.
  2. transfer and transferFrom require balanceOf(from) >= IProtocol(protocolContract).getAirdropPortion(from) + amount and consult inWhiteList to waive the 3% fee, so the unverified protocol contract decides how much of any holder's balance is spendable.
  3. On 7 August 2022 at 21:16:18 UTC the operation wallet 0x4c0CE1c7...595D sold 50,000 DMA through the QuickSwap router for about 42,028 USDT (tx 0x7bbe8cc7…348c30), using DMA it already held.
  4. At 22:44:08 UTC the same day the deployer 0xF491f49c…087B9c called transferToken(sender, recipient, amount) on the protocol contract (tx 0x70ce1369…7129d2), moving 38,000,000 DMA from it to 0x4c0CE1c7...595D.
  5. De.Fi's listing says that wallet drained the pools after receiving the 38,000,000 DMA. PeckShield put the loss at about $3.5M with the proceeds apparently sent to centralized exchanges, and CoinDesk reported DMA down 99.7%.

Protocol details

Classification Gaming / Metaverse / Rugpull
Protocol Type Exit Scam/Rugpull
Affected asset / contract DMA
Protocol links Website @dragoma_club

Evidence

Same attack technique

Browse all hacks →
Hyperliquid L1 HyperVault $3.6M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes