Friendchips.tech Rug Pull

Reported loss $39K
Rugpull

What happened

FRIENDCHIPS is an ERC20 token on Ethereum whose contract creates no supply at deployment and instead lets any minter-role address mint without a cap, while the deployer also holds the owner and operator roles. Etherscan shows that on 2023-09-15 the deployer called a separate contract (0x1dB0B601…281E40) in transaction 0x1cbc2774…5614ab; the page lists a mint of 100 million FRIENDCHIPS to that contract, its transfer into the Uniswap V2 pool, and 47.94 WETH paid out by the pool. De.Fi's REKT database lists the incident as a rug pull of 39,276 USD (23.94 WETH), puts the worth of the dumped tokens at 77,383 USD, and says the deployer had earlier added 24 WETH of liquidity and later moved the proceeds through Tornado Cash.

ChainAegis by SharkTeam flagged the token as a suspected rug pull the next day, saying the deployer removed a significant part of the liquidity and the price fell about 100 percent. The deployer address is 0x99856ab3…A10b33.

How it happened

  1. The constructor mints nothing: constructor(address _teamWallet) public ERC20("Friendchips.tech", "FRIENDCHIPS") only sets up the Uniswap pair and exemptions, so the supply that exists was created by later mint calls. The deployer receives every privileged role: MinterRole runs _addMinter(msg.sender), Ownable sets the deployer as owner, and operator = _msgSender();.
  2. Minting has no cap and no timelock. function mint(address _to, uint256 _amount) public onlyMinter { _mint(_to, _amount); } lets any minter create any amount for any address, function mint(uint256 amount) public onlyOwner returns (bool) { _mint(_msgSender(), amount); ... } lets the owner mint to itself, and function addMinter(address account) public onlyMinter lets a minter hand the role to any other address, including a contract. Nothing in the source calls renounceMinter or renounceOwnership.
  3. Newly minted tokens can be sold into the pool, which pays out WETH from the liquidity that buyers and the deployer supplied. The transaction page for 0x1cbc2774…5614ab shows exactly that sequence: 100 million FRIENDCHIPS minted (from the zero address) to 0x1dB0B601…281E40, sent to the pair, and 47.94 WETH released by the pool. The page labels the call deposit(uint256 vowID) on an unverified contract created by the deployer.
  4. Separately, the fee and trading switches would let the privileged wallets block or tax other holders. updateSellFee (owner only) allows up to 100 percent (require( _teamFee.add(_liquidityFee) <= 100, ...)); at 100 a non-exempt seller hits feeAmount = amount.mul(sellFee).div(100); sendAmount = amount.sub(feeAmount);, so super._transfer(sender, address(this), feeAmount) debits the seller's whole amount and super._transfer(sender, recipient, sendAmount) sends 0 to the pair. openTrading(bool bOpen) (operator only) can set tradingOpen back to false, after which require(tradingOpen == true, "Trading is not yet open.") reverts every transfer that does not involve the owner or an isExcludedFromFee wallet. The exemption in _transfer is if (sender == owner() || recipient == owner() || isExcludedFromFee[sender] || isExcludedFromFee[recipient]), so it covers only the owner and wallets the operator has marked through setExcludeFromFee; holding the operator role does not exempt a wallet by itself. The sources opened do not show these two switches being used.
  5. What happened, per the listings: De.Fi's REKT database lists the deployer as having added 24 WETH of liquidity, minting through a malicious contract and dumping, for 39,276 USD (23.94 WETH), and then withdrawing the funds via Tornado Cash. ChainAegis described the event as the deployer removing a significant portion of the liquidity. Those accounts differ in mechanism; the opened Etherscan transaction supports the mint-and-sell reading, and the Tornado Cash step was not checked here.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract FRIENDCHIPS

Evidence

Same attack technique

Browse all hacks →
BNBpay $54K lost Yzer Token $29K lost Helio Protocol $178K lost Boost Coin $593K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes