Evilswap Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

De.Fi's REKT database lists Evilswap on BNB Smart Chain as an exit scam / rug pull dated 2021-08-27, with no loss amount. The verified farm source embeds an EvilToken whose _transfer contains owner-configurable restrictions: any transfer sent by an owner-listed LP address must be smaller than 100 raw units, and transfers to an owner-set address above a threshold the owner also sets revert. The owner can also mint without a cap, and the MasterChef accepts a deposit fee of up to 100%.

The source shows these controls, not that they were used.

How it happened

  1. The owner of the token can register an address with function updateLPAddress(address lpAddress) public onlyOwner{ _tlpAddress.push(lpAddress); }. There is no function to remove an entry from _tlpAddress.
  2. In _transfer, a transfer whose sender is on that list must be tiny: if (checkLPAddress(sender) == true ) { require(amount < 100, "Transfer amount exceeds the maxTxAmount."); }. An LP pair that was listed is the sender when it pays tokens out to a buyer or to a liquidity remover, so those transfers revert unless they are below 100 raw units (100 / 10**18 of a token). Holders sending to the pair are not blocked by this line, because the sender is the holder.
  3. The owner can also set a second restricted recipient with function updateOwner(address newOwnerAddress) public onlyOwner { _tOwnerAddress = newOwnerAddress; }. This _tOwnerAddress is a separate variable, not the Ownable owner. The check is if (sender != _tWhiteList && recipient == _tOwnerAddress) { require(amount < _burnFee, "Transfer amount exceeds the maxTxAmount."); }, so if the pair were set as that recipient, a sale by any sender other than the single whitelisted address would need amount < _burnFee.
  4. _burnFee starts at 500 * 10**18 and the owner can change it with function setBurnFee(uint256 burnFeePercent) public onlyOwner { _burnFee = burnFeePercent * 10**18; }. Setting it to 0 makes amount < _burnFee impossible, so every transfer to _tOwnerAddress from a non-whitelisted sender reverts. setWhiteList lets the owner exempt one sender address.
  5. The owner can mint without limit: function mint(uint256 amount) public onlyOwner returns (bool) { _mint(_msgSender(), amount); return true; }. Ownable also has renounceOwnership, so these powers could be given up; the source does not show whether that happened.
  6. In the MasterChef, set accepts a deposit fee of up to 10000 basis points (require(_depositFeeBP <= 10000, "set: invalid deposit fee basis points");), and fees go to feeAddress; updateEmissionRate(uint256 _evilPerBlock) has no cap.
  7. What happened: De.Fi's REKT database lists the project as an exit scam on 2021-08-27. No transaction was opened showing updateLPAddress, updateOwner, setBurnFee, mint or any blocked trade.

Protocol details

Classification Exchange (DEX)
Protocol Type Exit Scam/Rugpull
Affected asset / contract EVIL
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain Haikyu Loss not disclosed Polygon Glockswap Loss not disclosed BNB Chain Deerdefi Loss not disclosed BNB Chain Antisocial.finance Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes