Incident Overview
The token creator of the GST token rugpulled the project and made off with a profit of 507 $BNB.
Assumedly in an attempt to make the project look legit the token creator send 222m $GST token to the FTX exchange in time of deploying token:
https://www.bscscan.com/tx/0x4ec84522…7a699c
The token creator proceeded to establish a liquidity pool on PancakeSwap, bootstrapped with 100 $BNB and 666m $GST token:
https://www.bscscan.com/tx/0x557d4b88…6db6d8
After an acceptable price appreciation the token creator dumped the $GST token against $WBNB through various self-destructible smart contracts;
1) https://bscscan.com/tx/0x57c00299…a7b557
2) https://bscscan.com/tx/0xb4378d63…21977b
3) https://bscscan.com/tx/0x962bf971…a3287e
The token creator received 607 $BNB in total from these transactions. The funds have since been funneled through a plethora of wallets seemingly to finance new scam projects.
Token creator wallet address:
https://bscscan.com/address/0x1155d95a…c9fee1
Subset of associated wallet address:
https://bscscan.com/address/0xe9b887d3…31fffe
https://bscscan.com/address/0x3df944e5…2de4f3
https://bscscan.com/address/0x2d9bb248…a3312a
https://bscscan.com/address/0x48cdad96…b2fb65
Incident Report
Protocol Information
Market Context at Time of Hack
What the Attacker Needed to Succeed
Understanding the prerequisites for this type of attack helps auditors identify protocols that are most at risk and helps developers build better defenses.
What Auditors Should Check
If you're auditing a protocol with similar architecture to GST Token, these are the critical security checks that could have prevented this incident (July 2022).
- Verify all logic paths related to Rugpull are guarded by proper access controls and input validation
- Review privileged functions (owner, admin, governance) for potential abuse vectors - centralization risks should be documented and bounded with timelocks or multi-sigs
Master these auditing techniques with hands-on labs and real exploit scenarios in the Smart Contract Hacking course.
Free TrialLearn to Prevent the Next GST Token
The GST Token hack is one of many attacks that skilled auditors are trained to detect before deployment. Master real exploit patterns and defense techniques with hands-on Web3 security training.