What happened
EC token (EC) is a BNB Chain token at 0xE7a4d466…637795, deployed on 21 March 2023 by 0x58819Da1…8d9514, which is still its owner. The constructor sends the entire 100,000 EC supply to a hard-coded address that is the deployer itself, and the owner can add any address to a blacklist through setBlacklistMul or setBlackListsMul; a blacklisted holder can neither send nor receive EC, and blacklisting the USDT pair would stop all trading. The token's BNB pair is blacklisted from deployment, and ordinary holders can never move more than 99.99% of their balance in one transfer.
CertiK reported on 24 March 2023 that the deployer removed about $43,800 from the liquidity pool, causing 98% slippage. De.Fi's REKT database lists the event as a rug pull in which the deployer removed liquidity and sold a large quantity of EC, citing liquidity removal transaction 0x7f758868…388c9f.
How it happened
- The constructor creates USDT and BNB pairs, credits all 100,000 EC to
mainAddres(0x58819Da1..., the deployer) and whitelists it, and immediately setsblackLists[uniswapV2PairBNB] = true, so the BNB pair cannot trade unless the owner removes it from the blacklist withsetBlacklistMulorsetBlackListsMul(..., false). setBlacklistMulandsetBlackListsMulareonlyOwnerand setblackListsfor any list of addresses._transferchecks both ends:require(!blackLists[from], ...)andrequire(!blackLists[to], ...), so a listed holder cannot sell or transfer, and listing the USDT pair would block every buy and sale.- Non-whitelisted senders hit
if (amount > balanceOf(from).mul(9999).div(10000)), so they can never sell their full balance in one transaction; the owner decides who is whitelisted throughsetWhitelistMulandsetStakeAddress. - Buys pay a fixed 1% and sells a fixed 2% to
pointAddress, which the owner can redirect withupdatePointAddress;takeOutlets the owner withdraw any token held by the contract itself. - CertiK reported that the deployer removed about $43,800 from the pool, causing 98% slippage.
Protocol details
Evidence
- report @CertiKAlert incident report twitter.com
- report CertiK Alert: large liquidity removal on EC token (EC) twitter.com
- transaction EC token contract creation transaction bscscan.com
- transaction bscscan.com transaction 0x7f75…8c9f bscscan.com
- address EC (CUPIDToken) verified contract code on BscScan bscscan.com
- address bscscan.com address 0x5881…9514 bscscan.com
- analysis Sourcify match for 0xE7a4d4669Ad6b445F213e213768d0673c2637795 on BNB Chain repo.sourcify.dev
- analysis De.Fi REKT database listing for EC de.fi
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
