Foxi.finance Rug Pull

Reported loss $16K
Ethereum
Rugpull

What happened

FOXI is an Ethereum ERC-20 whose owner can call addPhase(address account, uint256 amount), a mint that credits any balance without limit and, unlike the constructor's _mint, never updates _totalSupply. The contract also lets the owner add addresses to a gov list with addGov, and _transfer rejects any transfer whose sender is on that list.

Etherscan shows both steps on 2020-11-17. At 02:32:06 UTC the deployer address 0xbC9A17F1…D80D39 called addPhase and 500 quintillion FOXI (raw value 500000000000000000000000000000000000000) were credited to itself (transaction 0x1218cd9a…19209d). At 02:33:43 UTC, 97 seconds later, the same address sold 500 billion FOXI on Uniswap V2 with swapExactTokensForETH for about 32.12 ETH (transaction 0x82f7533a…0335c2).

How it happened

  1. The constructor of FOXI mints the initial supply once with _mint(msg.sender, totalSupply);, and _mint raises _totalSupply. A current-state read on 2026-09-30 returned 60,000,000 FOXI (60000000000000000000000000 raw) from totalSupply().
  2. A second minting path exists: function addPhase(address account, uint256 amount) public onlyOwner returns (bool) { _phase(account, amount);. _phase runs _balances[account] = _balances[account].add(amount); and emit Transfer(address(0), account, amount); but never touches _totalSupply, so tokens created this way do not appear in the supply figure that totalSupply() returns. There is no cap, cooldown or recipient restriction.
  3. The owner can also freeze senders: addGov(address[] memory account) sets gov[account[i]] = true; and _transfer starts with require(!gov[sender]. A listed holder cannot send or sell. Listing the pair address would stop it from sending tokens to buyers. No opened transaction shows this list being used.
  4. The owner role is transferable and can be given up (transferOwnership, renounceOwnership). A current-state read on 2026-09-30 returned the deployer address as owner().
  5. What happened, per Etherscan: transaction 0x1218cd9a…19209d called addPhase from the deployer address and credited 500000000000000000000000000000000000000 raw FOXI (500 quintillion FOXI at 18 decimals) to that same address at 02:32:06 UTC on 2020-11-17. At 02:33:43 UTC transaction 0x82f7533a…0335c2 swapped 500 billion FOXI for about 32.12 ETH. At the historical price of $482.71 per ETH shown on the Etherscan page, that is roughly 15.5k USD.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract FOXI
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Ethereum K3psav.Finance $3K lost Ethereum x20 finance $3K lost Ethereum SAV3R $10K lost Ethereum Walletreum $138K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes