Elastic Staking Rug Pull

Reported loss $209K
Ethereum
Rugpull

What happened

Elastic Staking (EStake, 9 decimals) is an Ethereum token contract at 0x88f63918…0225e8, deployed by 0xa4715671…A2539c in the transaction 0x5f767b81…783b15. Its constructor credits the entire initial supply of 1,210,000 tokens to the deployer, and the source lets a single owner-chosen Distributor address overwrite any holder's balance and the total supply. Nothing in the code caps those writes or says what the Distributor contract does.

De.Fi's REKT database lists the project as an exit scam / rug pull on 2021-01-26 with a loss of 208,514 USD. The listing's transactions, kept here: the deployer airdropped tokens to community members in 0xe1faff1c…2631e3, 0x563523b4…92fd64 and 0xc9c4771b…40ed6c. Once liquidity had grown, the listing says the deployer called an unverified contract through method 0x8a4995ae three times (0xd08a5d8a…6b491e, 0xdd255f83…d6a85d, 0xb0f8eedc…0cd4c5) to mint more tokens onto its wallet, then sold tokens in 0xb5a83eed…9aa32e, 0x5e315dee…2cb124, 0xb0f7e4d5…c8e77f and 0xc8e7050c…78e8ca. The Etherscan pages for the first call and the first sale confirm the sender and the sale (details in the steps below); the minting effect of the 0x8a4995ae calls is the listing's claim and was not independently confirmed.

How it happened

  1. What the code allows: the constructor sets _totalSupply = INITIAL_SUPPLY; and _updatedBalance[msg.sender] = _totalSupply;, so the deployer holds the full 1,210,000 EStake at launch.
  2. What the code allows: function setDistributor(address _Distributor) public onlyOwner { Distributor = _Distributor; } lets the owner point the token at any address, with no lock, timelock or limit on how often it changes. (lockOwnership only freezes transferOwnership; it does not lock setDistributor.)
  3. What the code allows: the Distributor can call function setUserBalance(address _user, uint256 _balance) public onlyDistributor { _updatedBalance[_user] = _balance; } and function setTotalSupply(uint256 _supply) public onlyDistributor { _totalSupply = _supply; }. Balances are plain numbers, so a Distributor can credit any wallet with any amount without a matching debit, and _totalSupply changes only through this setter. A current totalSupply read of 1,625,223 tokens (an eth_call on 2026-09-30, not a historical value) is above the 1,210,000 constructor supply, which in this source can only come from setTotalSupply; which transactions did that is not established here.
  4. What the code allows: balance credited this way is spendable like any other, so it can be sold into a Uniswap pool for real ETH.
  5. What was recorded: on 2021-01-26 the deployer address 0xa4715671…A2539c called method 0x8a4995ae on the unverified contract 0xfB842aD4…Cc9042 (block 11732400, per Etherscan). That selector is not a function of the EStake source; it is not the selector of setUserBalance (0xfe177700) or setTotalSupply (0xf7ea7a3d). Whether 0xfB84... is the token's Distributor is not shown by the opened pages.
  6. What was recorded: the same deployer address swapped 300,000 EStake for 43.38 WETH on the Uniswap V2 router in transaction 0xb5a83eed…9aa32e (block 11732384, 2021-01-26 16:18 UTC, per Etherscan). The listing counts 208,514 USD lost across the sales.

Protocol details

Classification Yield Aggregator
Protocol Type Exit Scam/Rugpull
Affected asset / contract EStake
Protocol links Website @ElasticStake

Evidence

Same attack technique

Browse all hacks →
Ethereum Aphrodite Protocol $97K lost Ethereum Binary Protocol $4K lost Ethereum Game Swap Exchange $23K lost Ethereum WOLF Protocol $30K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes