iProtocol Rug Pull

Reported loss $42K
Ethereum
Rugpull

What happened

iProtocol (IYP) was a reflection-style ERC-20 token on Ethereum with a hidden mint inside increaseAllowance. When the owner calls increaseAllowance with its own address as the spender while excluded from reflections, the function adds the amount directly to the owner's balance without changing totalSupply. The deployer sent tokens to the iProtocolPreSale contract, which collected presale funds and added the initial Uniswap liquidity.

On December 21, 2020 the deployer sold 4,000,000 IYP, eight times the 500,000 initial supply, into the pool for about 67.59 ETH, called increaseAllowance on itself for 9,000,000 IYP, and sold again. The record puts the loss at $41,930.

How it happened

  1. The constructor credits the whole 500,000 IYP supply to the deployer and creates the Uniswap V2 IYP/WETH pair. The deployer then funded the iProtocolPreSale contract, which added the initial liquidity in transaction 0xa109005b…22e893.
  2. The owner can put its own address in the excluded set with the onlyOwner function excludeAccount.
  3. increaseAllowance contains a branch that runs only when the caller is excluded, is the spender and is the owner. It adds addedValue to the caller's _tOwned and _rOwned balances, creating tokens that totalSupply (which returns _tTotal) never reports. The call still emits a normal Approval event, so it looks like an ordinary allowance change.
  4. The owner is exempt from _maxTxAmount, so it can sell any amount in one transaction.
  5. On 2020-12-21 at 04:38 UTC, the deployer sold 4,000,000 IYP through the Uniswap router for about 67.59 ETH (0xcca01f5d…7e1018). At 04:42 UTC it called increaseAllowance with itself as spender and 9,000,000 IYP (0x0b5944f6…51ffba), then sold 1,000,000 IYP for about 0.77 ETH at 04:47 UTC (0x0403198f…0cfffa) and 95,000 IYP for about 0.06 ETH on 2020-12-22 (0xaeac86a7…cc66e4).

Protocol details

Classification Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract IYP
Protocol links Website @iprotocol_io

Evidence

Same attack technique

Browse all hacks →
Ethereum FutureBase.Finance $4K lost Ethereum Sonic Swap $824 lost Ethereum Overbase Finance $4K lost Ethereum Prophet Project $46K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes