Elongate Deluxe Rug Pull

Reported loss $230K
Rugpull

What happened

Elongate Deluxe (ELongD) was a SafeMoon-style reflection token on Ethereum at 0x348B7f31…CE4d1B, deployed on 28 April 2021 by 0x28eD88c5…BC4DbC. Its code lets the owner set the three transfer fees to any value with no cap, including a total above 100% that makes every fee-paying transfer revert, and lower the per-transfer limit to zero for everyone the owner has not whitelisted. It also ships SafeMoon's lock()/unlock() pair, which shows the owner as the zero address while letting the previous owner reclaim control later.

The loss itself came from the liquidity pool. On 8 August 2021, 0xE8478d32…27B348 withdrew LP tokens from the UNCX Network LP locker 0x663a5c22…9db214 and removed liquidity from the Uniswap pool in five transactions. De.Fi's REKT database lists it as an exit scam, says the deployer had deposited those LP tokens in the locker, and puts the total at 86.41 WETH, about $230,455.

How it happened

  1. setTaxFeeBasisPoint, setLiquidityFeeBasisPoint and setFeeToBurnBasisPoint are onlyOwner and store any value. Each fee is _amount.mul(fee).div(10000), and _getTValues subtracts all three from the amount, so fees can take almost the whole transfer, and a total above 10000 makes sub revert for every holder who is not fee-exempt. The owner is fee-exempt from the constructor.
  2. _transfer requires amount <= _maxTxAmount unless the sender or recipient is in bypassesMaxTxAmount. _maxTxAmount starts at 0, and setMaxTxBasisPoint(0) returns it to 0 at any time, which blocks buys from and sells to the pair for every wallet the owner has not added with addBypassMaxTx.
  3. lock(time) copies the owner into _previousOwner and sets _owner = address(0); unlock() restores it once the time passes. A zero owner() therefore does not prove these powers were given up.
  4. What happened: according to De.Fi, the deployer 0x28eD88c5…BC4DbC had deposited the ELongD/WETH LP tokens in the UNCX Network LP locker 0x663a5c22…9db214. On 8 August 2021 at 22:06:39 UTC, 0xE8478d32…27B348 called Withdraw on the locker (tx 0xf853c2db…3b2ca8).
  5. Between 23:01 and 23:22 UTC the same address called Uniswap V2 Router 2 five times to remove liquidity (txs 0x87ecb8c8…b226ae, 0x3fe425b5…15dd9c, 0xc9e5e973…1d0fb7, 0x45ce33a3…d54ac1 and 0xe984071a…1136b5). The last one alone burned 54,484.877 LP tokens for 5.18 ETH. De.Fi puts the total at 86.41 WETH.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ELongD

Evidence

Same attack technique

Browse all hacks →
Rimau Finance Loss not disclosed VIVAToken Loss not disclosed Photon-Swap Loss not disclosed Polygon Beets Farm Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes