Golden Bar Farm Rug Pull

Reported loss Not disclosed
Rugpull

What happened

Every transfer of the GOLD token takes a hard-coded 15% fee. _transfer debits the full amount from the sender, credits the recipient with 85% and credits the other 15% to 0x71fad8Aa…92dC72, the address that deployed the contract. The fee has no setter or exemption list, so it applies to buys, sells and wallet-to-wallet transfers alike.

The owner can also call mint to create new tokens for itself with no cap. De.Fi's REKT database lists the token as an exit scam/rugpull dated 2021-09-03; the code shows the fee and the mint power, not whether the mint was used or liquidity was removed.

How it happened

  1. _transfer computes the fee: uint256 fee = amount.mul(15).div(100); and fixes the recipient: address feerecipient = 0x71fad8Aa358C866c1Af8637ac034A8869192dC72;. Both transfer and transferFrom call _transfer, so no path avoids it.
  2. The sender is debited the full amount (_balances[sender] = _balances[sender].sub(amount);), the fee address is credited (_balances[feerecipient] += (fee);) and the recipient receives amount.sub(fee). Sending 100 GOLD credits 85 to the recipient and 15 to the fee address. A liquidity pair receiving a sale gets 85% of the amount sold.
  3. The event log overstates the recipient's credit: emit Transfer(sender, recipient, amount); logs the full amount even though the recipient was credited only amount.sub(fee), on top of a separate emit Transfer(sender, feerecipient, fee);.
  4. function mint(uint256 amount) public onlyOwner returns (bool) { _mint(_msgSender(), amount); } adds to the owner's balance and to _totalSupply with no maximum. The code allows the owner to create tokens and sell them into liquidity; no transaction was opened showing this happening.
  5. transferOwnership and renounceOwnership exist, so the mint power can be moved or given up, but nothing in the code forces that.

Protocol details

Classification Yield Aggregator
Protocol Type Exit Scam/Rugpull
Affected asset / contract GOLD
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Red Eagle Token Loss not disclosed Stonks Token Loss not disclosed Fire Swap Loss not disclosed BNB Chain PuffinSwap Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes