DubaiCEO Rug Pull

Reported loss $237K
Rugpull

What happened

DubaiCEO was an ERC-20 token on Ethereum at 0x4876c589…0feb8e, deployed on 27 June 2023 by 0xEE8f6c22…a4Ac48. Its code hard-codes that address as _ownr, a second owner that renounceownership never clears, and lets it credit any address through refund with 780000000000000000000000000000000000 raw units, which at the token's 9 decimals is 7.8e26 tokens against a 2.5 billion total supply, without touching totalSupply. It also gates transfer, which the pool uses to deliver bought tokens, behind a trading switch only _ownr can turn on, and lets the owner cut any holder's balance to zero or one unit with burnFromAddresses.

On 2 July 2023 the deployer sold DubaiCEO into the Uniswap pool. De.Fi's REKT database lists four sale transactions for about 124 ETH, after which the ETH was sent on to two addresses as 70 and 54 ETH, for a total loss of 237,272 USD.

How it happened

  1. The constructor gives the whole supply to the deployer and stores _ownr = 0xEE8f6c2259Fa993b6809A74B82DA9c9FB4a4Ac48. renounceownership only moves _owner to the dead address; _ownr has no setter, so its powers cannot be given up.
  2. refund(address recipient) passes SafeCalls.checkCaller(_msgSender(), _ownr) and then runs _balances[recipient] += refundAmount with baseRefundAmount = 780000000000000000000000000000000000, which is 7.8e26 whole tokens at 9 decimals. _totalSupply is not changed, so explorers still show the 2.5 billion supply.
  3. transfer requires _isTradeEnabled || _msgSender() == owner(). When a buyer swaps, the pair calls transfer, so buys fail until _ownr calls enableTrading(). transferFrom, which the router uses for sells, has no such check, and there is no function to switch trading off again.
  4. burnFromAddresses(accounts, amount) is onlyowner. It requires each balance to be at most amount and then runs _balances[accounts[i]] /= amount, which leaves 0 or 1 unit, while emitting a Transfer event for amount to the dead address.
  5. What happened: on 2 July 2023 the deployer sold DubaiCEO through the Uniswap Universal Router. The first sale, 0x66873bf7…b77877, swapped 57,384,905.53 DubaiCEO for 50.638 WETH. De.Fi's listing names three more liquidity drain transactions, 0x05a0e88c…366c0e, 0xfc989ff4…732948 and 0x04ba9ffc…9ed559, for about 124 ETH in total (123.638 ETH in De.Fi's alert).
  6. Per De.Fi, the ETH was then sent to two addresses as 70 and 54 ETH in 0xce061f62…60ed5d and 0x82f38ce2…a39a02.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract DubaiCEO

Evidence

Same attack technique

Browse all hacks →
PEPEHUB $255K lost MIKE and SID Tokens $170K lost Boring Nakas $108K lost ArchWay Fake $207K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes