Fake Polyhedra Network Rug Pull

What happened

A fake Polyhedra Network token (ZK) on Ethereum was a honeypot: its transfer check lets each ordinary wallet sell only up to 0.04 ETH worth in total and silently skips any larger transfer, so buyers could not exit. The deployer 0x99514F84…D4F8f7 then removed the Uniswap V2 liquidity in two transactions on March 16 and March 18, 2024, taking about 102.9 ETH. De.Fi's REKT database lists the loss at about $400,000; CertiK put the loss at about $135,000 once the scammers' own added funds are discounted, and reported that the token was promoted in a scam Telegram channel.

How it happened

1. The constructor sends the full supply to the deployer, sets master = owner() and adds the owner to _marketersAndDevs, a whitelist that bypasses every transfer check.
2. For any other wallet selling to the pair or router, _canTransfer returns true only if bought >= sold + amount && _theNumberBNB >= soldBNB + amountBNB, with _theNumberBNB = 0.04 ether. The owner can change that cap with setNumber, including to 0.
3. When the check fails, transfer and transferFrom skip _transfer but still return true. A sell through the router therefore moves no tokens into the pair and the swap reverts, so holders stay stuck.
4. The owner also holds a hidden mint named rewardHolders, which runs _balances[owner()] += amount; _totalSupply += amount;, and the constructor gives master an unlimited allowance over the pair's own ZK balance (_allowances[address(pair)][master] = ~uint256(0)), plus syncPair() to resync reserves. Ownable here has no renounceOwnership or transferOwnership, so these powers cannot be given up.
5. On 2024-03-16 the deployer called removeLiquidityETHWithPermit on Uniswap V2 Router 2 and received about 40.67 ETH and 204,535 ZK (tx 0xc36e6623…e70a5c).
6. On 2024-03-18 a second removeLiquidityETHWithPermit from the same address returned about 62.24 ETH and 54,772 ZK (tx 0x1242bb80…d6a704).

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract ZK

Evidence

• report CertiK Alert on X: exit scam on a fake Polyhedra Network twitter.com
• transaction Etherscan transaction 0xc36e6623...a70a5c (removeLiquidityETHWithPermit) etherscan.io
• transaction Etherscan transaction 0x1242bb80...d6a704 (removeLiquidityETHWithPermit) etherscan.io
• address Polyhedra Network (ZK) verified contract source, Etherscan etherscan.io
• address etherscan.io address 0x9951…f8f7 etherscan.io
• analysis Sourcify match, chain 1, 0xe5295855523c5802Feb6D70105CF00bfE8F9c832 repo.sourcify.dev