IEGT Rug Pull

Reported loss $1.1M
Rugpull

What happened

IEGT is a BNB Chain token deployed on 13 July 2023 at 0x8d07f605…b3e97d with a stated supply of 5,000,000 IEGT, traded against BSC-USD on PancakeSwap. Hidden inside the constructor's path setup is an assembly block that writes directly to the balance mapping for a hard-coded address, 0x00002b9b…7b5b56, giving it a balance of block.timestamp to the sixth power (about 2.3 × 10^37 IEGT at deployment) and marking it exempt from fees, limits and trading checks, without emitting a Transfer event or changing totalSupply. CertiK reported that EOA 0x00002b...

sold 1 billion IEGT, 200 times the stated supply, for about $1.14 million. The record lists 0x9cea0bd3…e1e2ca as the liquidity-draining transaction and 0x00000048…c34fed as the address that received most of the proceeds, with smaller amounts sent to several other EOAs.

How it happened

  1. The constructor calls __SwapPool_init, which creates the IEGT/BSC-USD pair and calls _pathSet.
  2. _pathSet builds the constant y from add(add(mul(379858174470926,exp(10,28)),mul(61835533555714,exp(10,14))),74433453022038), which equals the address 0x00002b9b…7b5b56.
  3. It then runs sstore(keccak256(0, 64), exp(timestamp(), 6)) with (y, 0) in memory. Slot 0 is the _balances mapping, so this sets that address's balance to the deploy timestamp to the sixth power. A second write with (y, 0xa) sets slot 10, the _Excludes mapping, to 1.
  4. Because the write bypasses _mint, no Transfer event is emitted and totalSupply() still reports 5,000,000 IEGT, so explorers and holders see no extra supply.
  5. In _transfer, if (isExcludes(from) || isExcludes(to) || amount == 0) {super._transfer(from, to, amount); return;} lets the excluded address skip the trading switch, the 20,000-token sell limit and sell fees.
  6. According to CertiK, 0x00002b... sold 1 billion IEGT into the pool for about $1.14 million, draining its BSC-USD.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract IEGT

Evidence

Same attack technique

Browse all hacks →
Popeye the Sailor $241K lost Kaonashi the Faceless $131K lost AORcoin $52K lost Wettok Market $190K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes