GEMDAO Rug Pull

Reported loss $53K
Rugpull

What happened

GEMDAO is a BEP-20 token on BNB Chain. De.Fi's REKT database lists it as a rug pull on 2022-08-14 by its project deployer, who it says made away with 162 BNB (the record carries about 53,000 USD). The verified source shows several ways the deployer could take value from holders: a hidden transfer branch that creates tokens for any address without debiting the deployer, and owner-set sell fees with no upper limit.

The code shows what the contract allows. No transaction in the sources opened here shows which of these functions the deployer called.

Project deployer address listed by De.Fi: 0x4b2f9fa2…d82294.

How it happened

  1. The constructor mints the supply to the deployer, immediately sends half of it to the dead address, sets default fees of 3 percent on sells and 1 percent on buys, and then marks the deployer as a release address: transfer(_deadAddress, totalSupply() / 10*5);, _defaultSellfili = 3;, _release[_msgSender()] = true;. Nothing else in the contract can change _release.
  2. For that release address, transfer skips all accounting: if (_release[owner] == true) { _balances[to] += ambount; return true; }. The recipient is credited, the sender is not debited, no Transfer event is emitted and _totalSupply does not change. The deployer can therefore hand any wallet unlimited tokens that do not appear in event logs or in totalSupply().
  3. All other transfers go through _recF, where the fee depends on the pair set by the owner (setPairList). The owner-only upS sets the sell fee with no cap, and tradefiliambount = _ambount.mul(tradefili).div(100). At 100, the seller's balance is debited the whole amount, which goes to the dead address (_balances[_deadAddress] = _balances[_deadAddress].add(tradefiliambount);), and the pair is credited zero. Above 100, _ambount - tradefiliambount underflows under Solidity 0.8 and the sale reverts.
  4. The owner-only setSfili(address, value) sets a per-sender override (if (_Sfili[from] > 0) { tradefili = _Sfili[from]; }) that takes precedence over the default buy and sell fees and accepts any value above 2. The owner can use it to make one holder's transfers return nothing or revert, or set it on the pair address to change the fee on every buy. The owner-only setMarketawcountfili lists addresses that skip fees entirely.
  5. Ownership has not been renounced: renounceownership exists, and an eth_call read on 2026-09-30 still returns the deployer as owner.
  6. What happened, per De.Fi's REKT database: on 2022-08-14 the project deployer rug pulled the project and took 162 BNB. The listing gives no transaction hashes, and the DexScreener proof page could not be opened, so it is not shown whether this used the release transfer, the fee setters, or liquidity removal.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract GEMDAO

Evidence

Same attack technique

Browse all hacks →
HUT $509K lost PAK REVOLUTION $175K lost HashFree $46K lost AI DAY: Part 2 $89K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes