What happened
Hunter, listed as Hunter Global, marketed itself as an arbitrage bot service on BNB Chain, with the HOUND token (0x1e4402Fa…67A569). Around 8 May 2022, the team announced a contract upgrade. At the same time, the team wallet 0xcAA51c5C…E56626 removed the pool's liquidity and swapped about 1.1 billion HOUND for roughly 3,500 BNB, worth about $1.2 million. The project's website, X account and Discord then went dark. CertiK flagged the drain and said its audit had pointed out major centralization issues. The HOUND contract gave its owner unbounded fee setters, the power to exempt any address from fees, and control over where auto-generated liquidity tokens are sent.
De.Fi's REKT database lists three liquidity-removal transactions (0x0aec4347…8dde4a, 0x155d2f20…c51a1f and 0xfc30fcce…20bfef) and two swaps (0xb16dee69…33dd62 and 0x14cf5756…61373c). It also names the address 0x81d3ec77…17fe3b. The peakd post names 0xEb290E70…364f81 as a newly created recipient wallet.
How it happened
- The constructor creates the HOUND/WBNB pair, mints the whole supply to the owner, and exempts the owner, marketing wallet and foundation wallet from fees.
- Every other transfer, including buys from the pair and sells to it, pays
deadFee + marketingFee + foundationFee + liquidityFee + lpRewardFeepercent of the amount (initially 3 + 1 + 1 + 4 + 5 = 14%). A non-exempt seller can also move at most 90% of their balance in one transfer. - Each fee has an owner-only setter with no cap. If the fees add up to 100%, a sale delivers nothing; above 100%, the SafeMath subtraction in
takeAllFeereverts, so the transfer fails. - The owner can exempt any address from fees with
excludeFromFees. The owner can also pointliquidityReceiveAddressat any wallet, and the LP tokens thatswapAndLiquifycreates from the liquidity fee are sent there. - Liquidity removal needs none of these switches. The peakd write-up and De.Fi report that the team wallet 0xcAA5... removed the pool's liquidity and swapped the proceeds for about 3,500 BNB.
Protocol details
Evidence
- transaction bscscan.com transaction 0x0aec…de4a bscscan.com
- transaction bscscan.com transaction 0x14cf…373c bscscan.com
- transaction bscscan.com transaction 0x155d…1a1f bscscan.com
- transaction bscscan.com transaction 0xb16d…dd62 bscscan.com
- transaction bscscan.com transaction 0xfc30…bfef bscscan.com
- address Hound verified contract code on BscScan bscscan.com
- address bscscan.com address 0xcAA5…6626 bscscan.com
- analysis De.Fi REKT database listing for Hound (proof link: archive.is/SLN0f, not fetchable) archive.is
- analysis Sourcify match for 0x1e4402Fa427a7A835fC64ea6d051404ce767A569 on BNB Chain repo.sourcify.dev
- analysis DeFi Project "Hunter" - $1.2 Million Rug Pull (peakd, 9 May 2022) peakd.com
- analysis Hunter defi project rug pulls for $1.2 million (Web3 Is Going Great) web3isgoinggreat.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
