fcdep Rug Pull

Reported loss $675K
Rugpull

What happened

fcdep (EPMAX) is a BEP20 token built on a generic fee-and-reflection template. Its contract gives the full supply to the owner address chosen at deployment and leaves the owner with an uncapped fee setter, a fee-exemption setter and a mint function, and the token itself has no liquidity lock. CertiK's Skynet alert of 2023-04-21 reports a large liquidity removal on the token, with the deployer removing liquidity for about 674,000 USD.

De.Fi's REKT database lists the incident as an exit scam/rugpull of about 675,000 USD and says the team responsible for managing liquidity executed a liquidity removal and sold off the token, causing a drop of around 90% in its initial price. The listing names the deployer 0xca91ca94…b4fc8b as the scammer and a liquidity-removal transaction, 0xbc66cdb8…8a78ce, which this research could not open.

How it happened

  1. The constructor hands the whole supply and ownership to one address: _owner = tokenOwner; and _rOwned[tokenOwner] = _rTotal;. The owner read on 2026-09-30 is the deployer, 0xca91ca94…b4fc8b.
  2. Liquidity is not controlled by the token code. The contract has no lock, no vesting and no LP custody, so whoever holds the LP tokens from the pool can remove it at any time. CertiK's alert reports that the deployer did this for about 674,000 USD on 2023-04-21.
  3. The owner can also change what every other holder pays: function updateFee(uint256 _txFee,uint256 _burnFee,uint256 _charityFee) onlyOwner() public{ writes _TAX_FEE = _txFee* 100; with no upper bound. The seller is debited the full amount (_rOwned[sender] = _rOwned[sender].sub(rAmount);) and the recipient receives less (rAmount.sub(rFee).sub(rBurn).sub(rCharity)), so at a combined rate of 100 the recipient gets nothing and above 100 the subtraction underflows and the transfer reverts.
  4. Fee exemptions are owner-controlled: if (_isCharity[sender] || _isCharity[recipient] || _isExcluded[recipient]) { takeFee = false; }, and function setAsCharityAccount(address account) external onlyOwner() lets the owner flag any address, so an owner-chosen wallet can move tokens fee-free while other holders pay the owner-set rate.
  5. The owner can also call function mint(address account, uint256 amount) onlyOwner() public, which raises _tTotal and adds amount to _rOwned[account] without scaling by the reflection rate, so how much balance a call credits is not established from the code alone.
  6. What happened, per the listing and CertiK: the deployer removed the pool's liquidity and sold off the token, and the price fell about 90%. No transaction page was opened to confirm the amounts, and whether any fee or mint function was used is not shown by any opened source.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract EPMAX

Evidence

Same attack technique

Browse all hacks →
Ordinals Finance $1.0M lost Void.Cash $34K lost Pepe Coin $95K lost ANT Token $36K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes