Dreams Come True Rug Pull

Reported loss $26K
Rugpull

What happened

Dreams Come True (DCT) was a BEP20 token on BNB Chain whose owner held several switches over trading. Trading starts disabled, and until the owner sets a start time every transfer between non-exempt addresses reverts with notStartYet. The owner could also move that time back into the future, exempt any address, and choose the "auto pool" contract that receives a 5% sell fee and a 3% buy fee and is called on every trade, so a pool contract that reverts on sells would block selling.

The owner has since been set to the zero address, which locks these settings. On 6 February 2023 CertiK reported that DCT's price had slipped more than 94% after an address beginning 0x08cd2 removed $27,000 of liquidity and swapped about 3.4 million DCT for $9,700. That address had added $40,000 of liquidity in early January.

De.Fi's listing attributes the rug pull to the token deployer and puts the loss at $26,000.

How it happened

  1. The constructor mints all 50,000,000 DCT to the deployer and sets _startTradeTime=1e20;, so trading is closed from launch.
  2. For any transfer where neither side is exempt, _transfer runs require(block.timestamp >= _startTradeTime,"notStartYet");. The owner opens or closes trading at will with setStartTradeTime, and setExclude lets chosen addresses skip the check and all fees.
  3. A transfer to _ammPool (a sell) sends 5% to _cutPool and calls IAutoPool(_cutPool).OnSell(onepct.mul(5));; a buy sends 3% and calls OnBuy. The owner sets both addresses with setAmmPool and setAutoPool, so a _cutPool contract whose OnSell reverts would block every sell while buys keep working.
  4. A holder can never move their whole balance, because if(amount==_balances[sender]) amount=amount.subwithlesszero(1e16); keeps 0.01 DCT behind.
  5. The owner has since been set to the zero address, which only renounceOwnership can do, so these settings can no longer change. The loss itself came from the pool: CertiK reported that address 0x08cd2 removed $27,000 of liquidity and swapped about 3.4 million DCT for $9,700 on 6 February 2023, and DCT fell more than 94%.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract DCT

Evidence

Same attack technique

Browse all hacks →
OBB Token $156K lost Coin Merge $76K lost SUI Token $100K lost Zodiac Credit $33K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes