HUT Rug Pull

Reported loss $509K
Rugpull

What happened

HUT is a BNB Chain token whose entire capped supply of 3,333,333 HUT is minted to the deployer address in the constructor, and whose controls sit with a governance address and a set of hxkers that the governor can extend without limit. Those addresses can switch on a whitelist-only trading mode, blacklist any sender, and withdraw any token held by the contract, including the liquidity tokens the contract itself receives. Non-whitelisted holders pay an 11% fee on pair trades, lose 49% on wallet-to-wallet transfers, and can sell at most 30% of their balance per 24 hours, while the deployer address, which the constructor whitelists, is exempt.

On 2022-08-21 CertiK Alert posted that it saw a rug pull on HUT after the price dropped over 90%, saying 10,150 HUT from the initial distribution were sold for 509K USDT in an unverified USDT-HUT pool. De.Fi's listing gives the same 509,000 USD figure and names three addresses involved: the token deployer 0x6a5d9cae…efa162, and 0xb75664b6…3794cc and 0x20e79a18…370767.

How it happened

  1. The constructor sets the governor and mints the whole capped supply to the deployer: govn = msg.sender; and _hutlxlf(all, maxSupply); with all = 0x6A5d9CAE9630a509291cAB7eC6B07973E8eFA162 and maxSupply = 3333333 * 1e18. It also whitelists the deployer, once as all and once as msg.sender (witeeaddress[all] = true; witeeaddress[msg.sender] = true;; all is the deployer address), and makes the deployer and 0x99a51aAA... hxkers through adHIUTker; 0x99a51aAA... is an operator but is not whitelisted.
  2. Pair trades by anyone else are taxed and limited in _transfer. A non-whitelisted seller to the pair must satisfy require(oamount <= ouseramount * 3 / 10); and a rolling 24-hour total require(sellout[sender] <= ouseramount * 3 / 10); (30% of balance), then the sender is debited the full amount and the recipient receives amount.mul(89).div(100); the other 11% goes 2% to the contract (burned while the burn address holds under 3,319,202 HUT), 3% to backropadress, 4% to the contract and 2% to lpadress. Plain transfers between wallets keep only amount.mul(51).div(100), the other 49% going to the contract and burned.
  3. All of this is skipped when either side is whitelisted: if((witeeaddress[recipient]||witeeaddress[sender]) && isfeewhit) { }. The deployer address, being whitelisted, can sell to the pair without the 30% cap or any fee, and govn or any hxker can add more whitelisted addresses with setwiteeaddress2 or setWeaddress2.
  4. The same operators can stop trading for everyone else: setIscanswap(true) makes the pair branch require witeeaddress[recipient] on buys and witeeaddress[sender] on sells (require(witeeaddress[sender], " sender not witee swap")), and setblkddress2 blacklists any address, which isfeeblk enforces with require(blkddress[sender] == false, "ERC20:the blk address") on every transfer the address sends. The governor can also replace the pair (setpancakePair) and router (setpancakeswapV2Router).
  5. A path to liquidity exists for the operators: the contract's auto-liquidity routine calls addLiquidity(..., address(this), ...), so the liquidity tokens it mints stay in the token contract, and huyhxlk lets any hxker move any token held by the contract to themselves: require(hxkers[msg.sender], "hxker"); IERC20(ut).transfer(msg.sender, amount);. hutlxlf(address account, uint amount) also lets an hxker mint, but only up to maxSupply, so only tokens burned earlier could be re-minted.
  6. What happened, per CertiK Alert (2022-08-21): the token price dropped over 90% and 10,150 HUT from the initial distribution were sold for 509K USDT in an unverified USDT-HUT pool; De.Fi's listing reports the same 509,000 USD. No transaction was opened for this record, so it is not established which of the controls above, if any, was used, or whether the sale went through the contract's pancakePair.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract HUT

Evidence

Same attack technique

Browse all hacks →
Dogioh $65K lost PDR $25K lost PAK REVOLUTION $175K lost GEMDAO $53K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes