What happened
GMT is a BNB Chain token (not STEPN's GMT) deployed on 12 July 2022 at 0x59375348…8259c9. Its constructor gives the entire 1.3 billion supply to a hard-coded address, 0x732fa169…d3624a, which pays no transfer fees, and all trading through the PancakeSwap pair stays closed until the owner turns on a switch (takeSwapOff) unless an address is on an owner-controlled priority list. The deployer 0xe581611d…43dbb5 and the supply holder can also pull any token held by the GMT contract through setErc20With, a power that survives the later renouncement of ownership.
De.Fi's REKT database lists GMT as a rug pull: address 0x21075b8d…264eac, which the code names develop3Address, created the pool with 500,000 GMT and 209 BNB, and the supply holder later sold its tokens into it for a profit of about $11,800.
How it happened
- The constructor credits the whole supply to one hard-coded address:
_balances[acceptAddr] = _totalSupply;with_totalSupply = 1300000000 * 10**18. - The same constructor exempts that address and the deployer from fees and grants both the
turnOffOwnerflag:_isExcludedFromFee[acceptAddr] = true;andturnOffOwner[acceptAddr] = true;. - Any transfer to or from a pair reverts until the owner opens trading, unless one side is on the priority list:
require(isSwap, "not swap");, set byfunction takeSwapOff (bool _bool) external onlyOwner { isSwap = _bool; }and bypassed viasetPrioritySwap. - Addresses with the
turnOffOwnerflag can move any token the GMT contract holds:require(turnOffOwner[msg.sender], "no permission"); IERC20(con).transfer(addr, amount);. This check does not useonlyOwner, so it still works after ownership is renounced. - According to De.Fi's listing, 0x21075b8d…264eac added 500,000 GMT and 209 BNB as liquidity in transaction 0xac3b8a94…cbe408, and 0x732fa169…d3624a sold its fee-free supply into the pool in transaction 0xe5fca6c2…a703f9, taking about $11,800.
Protocol details
Evidence
- transaction GMT contract creation transaction bscscan.com
- transaction bscscan.com transaction 0xac3b…e408 bscscan.com
- transaction bscscan.com transaction 0xe5fc…03f9 bscscan.com
- address GMT verified source code bscscan.com
- address bscscan.com address 0x2107…4eac bscscan.com
- address bscscan.com address 0x732f…624a bscscan.com
- address bscscan.com address 0xe581…dbb5 bscscan.com
- analysis Sourcify match for 0x59375348e069fa7e0eb58b98f72d2dee078259c9 on BNB Chain repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
