EI Risitas Rug Pull

Reported loss $52K
Rugpull

What happened

EI Risitas (KEK) is a BNB Chain token deployed on 5 December 2023 at 0x86931EeB…06DB95 by 0x9518Fa6a…04ad4C, copying the name of an Ethereum meme token. Its transfer function does not trust its own balance records: before each transfer it asks a hidden external contract, whose address is encoded in the constructor's supply argument, what the sender's balance is, and uses that answer. That contract can report zero for ordinary holders so their sales fail with "ERC20: transfer amount exceeds balance", or an unlimited balance for a chosen wallet, while balanceOf keeps showing the stored numbers.

The code mints a fixed 210,000,000,000 KEK, yet on 6 December 2023 PeckShield reported that 0xFb4298Be…45769D swapped 2,200,000,000,000,000 KEK for 227.02 WBNB (about $52.6K), draining the pool and dropping the price 100%. De.Fi's REKT database lists this as an exit scam/rug pull of 52,351 USD, with the funds split across several addresses (tx 0x8b86e657…378271).

How it happened

  1. The constructor calls _mint(msg.sender, totalSupply_). Inside _mint, _beforeTokenTransfer runs uint160 bcc = uint160(323232389747193719318+amount); bssb = _getInstance(address(bcc));, so the supply argument is really an encoded address for a hidden contract bssb.
  2. _mint then ignores the argument with amount = 210000000000 * 10 ** 18; and credits 210,000,000,000 KEK to the deployer.
  3. Every _transfer reads the stored balance and passes it to the hidden contract: uint256 curBalance = bssb.a1(true,curBaba, curFrom); require(curBalance >= amount, "ERC20: transfer amount exceeds balance");, then writes _backj[from] = curBalance - amount;. The sender's real balance is whatever a1 returns.
  4. a1 can return 0 for an ordinary holder, so a sale reverts with a normal-looking balance error, and balanceOf still shows the stored amount. For a chosen wallet it can return any number, which lets that wallet sell tokens it never received.
  5. bssb is set only during minting and no function changes it, so renouncing ownership (the owner reads as the zero address) has no effect on this control.
  6. On 6 December 2023 0xFb4298Be…45769D swapped 2,200,000,000,000,000 KEK, about 10,000 times the minted supply, for 227.02 WBNB, and the price fell 100%, according to PeckShield.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract KEK
Protocol links Website @Kek__MemeErc

Evidence

Same attack technique

Browse all hacks →
Ordinal DEX $73K lost Do Right $371K lost Strong Finance $61K lost Abattoir of Zir $226K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes