FA Rug Pull

What happened

FA (FA) is a BEP-20 token on BNB Chain at 0xD229138c…1DF843, deployed on 14 December 2023 at 14:04 UTC by 0xb6a0BC69…87E515, which received the entire 1,000,000 FA supply. On 21 March 2024 CertiK reported that the deployer withdrew about 255k USDT and about 515k FA and sold the FA, for a net gain of $341k after subtracting the liquidity it had added. De.Fi's REKT database lists FA as an exit scam/rug pull with $255k reported lost.

The code has no blacklist or adjustable fee, but the owner can replace the fee-tracker contract that every taxed trade calls.

How it happened

1. The constructor mints the full 1,000,000 FA cap to the deployer and creates FA/USDT and FA/WBNB pairs. ERC20Capped prevents any later minting.
2. Trades with a pair in _isSwapInclude pay fixed fees totalling 2.5% in _transfer. One slice goes to lpDividendTracker, followed by lpDividendTracker.distributeCAKEDividends(lpFees), a call that is not wrapped in try.
3. The owner can point lpDividendTracker at any contract with setLpDividendTracker. A tracker that reverts in distributeCAKEDividends would make every taxed buy and sell fail. The owner can also move any token held by the FA contract with transferForeignToken.
4. On 21 March 2024 CertiK reported that the deployer withdrew about 255k USDT and about 515k FA, then sold the FA, netting $341k after accounting for its initial liquidity.

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract FA

Evidence

• report CertiK Insight: slippage on FA token twitter.com
• transaction FAToken contract creation transaction bscscan.com
• transaction bscscan.com transaction 0xa624…5a2a bscscan.com
• transaction bscscan.com transaction 0xd5d4…4a2a bscscan.com
• address FAToken verified source code bscscan.com
• address bscscan.com address 0xb6a0…e515 bscscan.com
• analysis Sourcify match for 0xD229138cB571A3c436338C0Ac90fBd60111DF843 on BNB Chain repo.sourcify.dev