Forest Tiger Pro Rug Pull

Reported loss $733K
Rugpull

What happened

Forest Tiger Pro (TIGER) is a BNB Chain token deployed on 31 May 2022 at 0x486eB84e…abf757. Its constructor mints 20.5 million TIGER to the owner and 500,000 to a second wallet, and marks both as isDelivers, which lets them skip the 10% buy and sell fees and the trading-time check. The owner can move swapTime to any date with changeSwapTime, which stops every buy, sell and liquidity move through the pool for everyone not on the isDelivers list, and can add any address to that list.

De.Fi's REKT database describes it as a rug pull by the token creator worth about $700k (its database figure is $732,647). According to De.Fi, insider wallets added about 3.6 million USDT of liquidity to the TIGER/USDT pool, bought about $55k of TIGER to raise the price, then removed the liquidity. One wallet's removal on 13 July 2022 made a profit of 500k USDT, and all the USDT was sent on to another address.

How it happened

  1. The constructor runs _mint(owner(), toPool) for 20,500,000 TIGER and _mint(_receiveToken, total.sub(toPool)) for 500,000 TIGER, then sets isDelivers for the owner and _receiveToken.
  2. In _transfer, any transfer where sender or recipient is in isDelivers goes straight to _basicTransfer, skipping fees and the swapTime check.
  3. Every other transfer from or to a pairList address runs require(block.timestamp >= swapTime, 'Can\'t swap!'). changeSwapTime is onlyOwner with no upper limit, so the owner can halt trading and liquidity withdrawals for ordinary holders while insiders stay exempt. setDelivers and setPairList let the owner change who is exempt and which addresses count as pools.
  4. According to De.Fi, the token creator sent all tokens from its balance to three staking contracts and two exchange contracts: 0xf28bd3d5…75691b, 0xf1e106bc…c4ed9b, 0x20cf8df3…b44e9d, 0x284bc017…32df81 and 0x722e161e…0f1bdd.
  5. De.Fi says wallet B, which held the 500k tokens, sent 35k TIGER to wallet C (0x10fe4704…5af0e8) and another 150k an hour later (0xe6744c64…d89df6).
  6. De.Fi says wallet B added 2.6 million USDT of liquidity to TIGER/USDT in three transactions (0x1465e26a…325504, 0x15f761f3…c00a70 and 0xcca2ebf3…7c458f), and wallet C added 1 million USDT and about 39k TIGER (0x7dc35d4f…bf5a58).
  7. De.Fi says wallet C then raised the price gradually with buys of about 8.7k USDT each, $55k in total, for example 0x76c9c19a…cc14e0, 0x179f31f3…b71d8e and 0x00ea3681…edd652.
  8. On 13 July 2022, per De.Fi, wallet C removed its liquidity with a profit of 500k USDT (0xd72bdfc1…39cff5). Wallet B then removed its liquidity as well (0xc03899a5…539d93), and all the USDT went to wallet D (0x8de16393…d9b84f and 0x96248173…9b817a).

Protocol details

Classification Gaming / Metaverse / Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract TIGER
Protocol links Website @ForestTigerPro

Evidence

Same attack technique

Browse all hacks →
Neoteric Finance $17K lost ElonMVP $44K lost RETAWATCH $29K lost SHADE INU Token $54K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes