EDAO Rug Pull

Reported loss $39K
Rugpull

What happened

EDAO is a BNB Chain token at 0x900882Be…0495c9, deployed on 18 February 2023 by 0x98F21362…bDEc76, whose deploy transaction (0x1ccfde17…b5cb81) credited the entire 20,000,000,000 EDAO supply to the deployer. The owner can switch buying off for everyone who is not fee-exempt with setSwap(), and sells depend on the owner-chosen fee address: once the contract holds 10,000 EDAO in fees, each sell tries to pull that address's USDT back into the contract with transferFrom, so the sell reverts if the fee address has not approved it. Trades with the pool pay a 3-10% fee set by the pool's LP supply, which the owner cannot change.

CertiK reported on 25 March 2023 that EDAO had dropped more than 99% and that about $39,300 in BSC-USD had been transferred to two externally owned accounts. De.Fi's REKT database lists it as a rug pull in which the project team spread the initial mint across several addresses and sold it on 25 March, citing swaps by 0x6fb985e3…c51cda and a swap hash given in truncated form as 0x2a446751547b0b6d22209aec4e6944f81daab2a770c72203e789a8de3ed40.

How it happened

  1. The constructor sets _tOwned[msg.sender] = _tTotal (20,000,000,000 EDAO), makes the deployer the fee address usdtOwner, exempts it from fees and creates the USDT pair.
  2. setSwap() is onlyOwner and flips isSwap. While it is true, every non-exempt purchase from the pair hits require(!isSwap, "can not buy") and reverts; sales are not affected by this switch.
  3. On a non-exempt sell, once the contract holds at least minsell (10,000 EDAO) in fees, _doSwapAndDividend swaps them to USDT for usdtOwner and then calls IERC20(usdt).transferFrom(usdtOwner, address(this), usdtAmount). If usdtOwner has not approved the token contract, that call reverts and the holder's sale fails with it. The owner can change usdtOwner at any time with SetFeeAddress.
  4. Holders that the owner marks with excludeFromFee skip the fee, the buy switch and the fee swap entirely.
  5. CertiK reported a price drop of more than 99% and about $39,300 in BSC-USD moved to two EOAs; De.Fi's listing attributes this to the team selling tokens from the initial mint.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract EDAO

Evidence

Same attack technique

Browse all hacks →
BWR $47K lost Finance $81K lost DESTINY Protocol $121K lost EC token $44K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes