Freedom Protocol | Raccoon Network Rug Pull

Reported loss $20.8M
Rugpull

What happened

Freedom Protocol sold FREE, a BNB Chain token deployed on 6 May 2022 at 0x880BCe93…606165, advertising an APY of more than 183,000%. Raccoon Network, a metaverse project with the RAC token at 0x371cF78d…2A6258, announced an investment from and partnership with Freedom Protocol in late June 2022. The FREE contract creates the advertised yield by raising the total supply by 0.021447% every 15 minutes, which compounds to roughly 183,000% a year: holders' balances grow with each rebase, while the PancakeSwap pair's balance is kept in a separate pairBalance that does not grow.

The owner could blacklist any sender or recipient, and every sale calls out to treasury and DAO contracts that the owner chooses, so a revert in either would block sales. On 19 July 2022 about 20.8 million BUSD was moved out of the two projects. On 20 July PeckShield flagged both as scams, saying about 20 million BUSD raised in the IDO had been sent to 0xf800f274…469336; Raccoon Network said the transfers were the result of a hack.

De.Fi's REKT database adds that users could not sell FREE after the IDO, that funds were withdrawn through Binance hot wallets via 0xdcf49591…843762, and lists 0x56bb6513…54502f, 0x088f4818…7f5b70 and 0x4411e7aa…be1214 as further involved addresses.

How it happened

  1. The constructor creates a PancakeSwap pair between FREE and the DAO contract's payToken(), credits the whole initial supply to the deployer, and exempts the deployer, the token and the DAO contract from fees.
  2. Every 15 minutes rebase() multiplies _totalSupply by (10**8 + 21447) / 10**8. Balances are stored as fixed "gons", so every holder's displayed balance rises, but the pair's pairBalance is a plain number that the rebase does not touch. The advertised yield is new supply, not income.
  3. A sale to the pair is capped at 99.9% of the seller's balance and pays 15% in fees (treasuryFee 5%, consensusFundFee 2.5%, daoFee 5%, firePitFee 2.5%) to addresses the owner sets.
  4. The owner can call setBlacklist(address, true); _transferFrom then reverts with in_blacklist whenever that address is the sender or the recipient, including the pair.
  5. The owner can also point setFreeTreasuryAddress and setFreeDaoAddress at any contract. Every transfer not sent by the pair calls the treasury's swapBack(), and every taxed sale calls the DAO's setDaoReward(), so either contract can make sales revert while buys still succeed. The treasury also receives an unlimited router allowance over its own FREE.
  6. Separately from the token code, on 19 July 2022 about 20.8 million BUSD left the projects; PeckShield traced about 20 million BUSD of IDO funds to 0xf800f274…469336.

Protocol details

Classification Yield Aggregator / Gaming / Metaverse
Protocol Type Exit Scam/Rugpull
Affected asset / contract FREE | RAC
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Saxon James Musk $26K lost TEDDY DOGE $4.5M lost Neoteric Finance $17K lost ElonMVP $44K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes