FlokiChain Rug Pull

Reported loss $111K
Rugpull

What happened

FlokiChain (FC) is a BEP-20 token traded on PancakeSwap. Its constructor mints the whole 10 trillion supply to one hard-coded address, address _owner = 0x19c943B6557a17176B4eD8c2D6081c7E71A5fD35; followed by _mint(_owner, totalSupply);, and makes that address fee-exempt and the contract owner. The owner can also change the sell tax to any value up to 100%, can switch fee-swapping off, and nothing in the contract locks the pool liquidity that the owner provides.

CertiK's Skynet alert of 11 October 2022 reported that the project owner removed liquidity worth about 110k USD, dropping the price by more than 99%. The earlier record puts the profit at 111,162 USD, adds that the funds were swapped for 407 BNB and sent to another EOA, and names 0x19c943b6…a5fd35 as the scammer address and 0x9df83e40…63044a as the liquidity removal transaction (De.Fi listing). The owner address in the code is the same address.

How it happened

  1. The constructor mints the full supply to the hard-coded owner: _mint(_owner, totalSupply); then transferOwnership(_owner);, and excludeFromFees(_owner, true); exempts that address from every fee.
  2. Trading is gated by the owner: if(!tradingActive){ require(_isExcludedFromFees[from] || _isExcludedFromFees[to], "Trading is not active."); }. enableTrading() is onlyOwner and cannot be undone.
  3. The sell tax is owner-adjustable with a ceiling of 100%: function updateSellFees(uint256 _liquidityFee) external onlyOwner { ... require(sellTotalFees <= 100, "Must keep fees at 100% or less"); }. At 100% a sell is debited from the seller (super._transfer(from, address(this), fees); amount -= fees;) while 0 tokens reach the pool, so the code allows a total sell block. This is what the code ALLOWS; no transaction is cited showing the tax was changed.
  4. The contract has no liquidity lock; the pool's LP tokens are held by whoever added the liquidity, which the source does not show.
  5. What was reported: CertiK's alert says the owner removed liquidity for about 110k USD, causing a price drop of more than 99%. The earlier record adds a swap into 407 BNB and a transfer to another EOA (transaction 0x9df83e40…63044a removed the liquidity per De.Fi).

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract FC

Evidence

Same attack technique

Browse all hacks →
KHABY Fan Token $33K lost LGT $35K lost The Micro Elements $573K lost Lets Go Farming Token $37K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes