Focus Rug Pull
What happened
FOCUS (FCS) is a reflection token with no mint function and an initial supply of 500,000 FCS (_tTotal = 500000 * 10**9), all assigned to the deployer in the constructor; the 5% burn per transfer shrinks _tTotal over time. The contract itself has no mint, blacklist, trading switch or sell block; every transfer is charged a 5% reflection fee (_taxFee, which the owner can set between 1 and 10) and a fixed 5% burn (_burnFee). Etherscan shows the deployer wallet 0x57887c46…e851EE adding the pool in 0x7a2a205e…256347 with 4 ETH and 425,250 FCS in return for 0.042305556 UNI-V2 LP tokens, so the deployer held the LP position.
It sent 27,657.1256 FCS to 0x2933dF4F…A41750 in 0xb0f55eaa…0f0134; De.Fi's REKT database lists that recipient as having sold the tokens (listed link: Source), which was not opened. On 2021-02-28 the deployer burned 0.041882501 of those LP tokens in 0xd0359495…2011a9 through removeLiquidityWithPermit and received 7.289244 WETH and 263,356.7278 FCS. De.Fi's REKT database lists the loss at 9,555 USD.
How it happened
- The constructor assigns the whole supply to the deployer:
_rOwned[_msgSender()] = _rTotal;with_tTotal = 500000 * 10**9. - The deployer wallet called
addLiquidityETHin 0x7a2a205e…256347, depositing 4 ETH and 425,250 FCS and receiving 0.042305556 UNI-V2 LP tokens in the same wallet. The token contract has no lock or restriction on those LP tokens. - The deployer wallet transferred 27,657.1256 FCS to 0x2933dF4F…A41750 in 0xb0f55eaa…0f0134.
- On 2021-02-28 the deployer wallet called
removeLiquidityWithPermiton Uniswap V2 Router 2 in 0xd0359495…2011a9, burning 0.041882501 LP tokens (about 99% of the 0.042305556 it received) and receiving 7.289244 WETH and 263,356.7278 FCS from the pool.
Protocol details
Evidence
- report Report focus-defi.com
- report FOCUS source (Sourcify, chain 1) repo.sourcify.dev
- transaction Etherscan transaction 0x7a2a205e...ef256347 (addLiquidityETH) etherscan.io
- transaction Etherscan transaction 0xb0f55eaa...0f0134 (FCS transfer) etherscan.io
- transaction Etherscan transaction 0xd0359495...2011a9 (removeLiquidityWithPermit) etherscan.io
- address FOCUS verified source (Etherscan) etherscan.io
- analysis bloxy.info page 0x2933…1750 bloxy.info
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.