IVY Rug Pull

Reported loss $1.8M
Rugpull

What happened

IVY is a BNB Chain token (0xf99f2Aec…9f1D30) traded against USDT (BSC-USD) on PancakeSwap. On 16 October 2023, CertiK flagged a price drop of more than 94% after the address 0x5c30d0a9…3de64b removed about $1.58 million of liquidity. Liquidity removal needs no special token code: whoever holds the pool's LP tokens can withdraw them. The contract also gives its owner a transfer blacklist, sell and buy fees with no upper bound, and switches that can close trading. A separate "funder" role, the fund address, keeps some powers even after ownership is renounced.

De.Fi's REKT database says the deployer 0x00B3aa7E…534B23 renounced ownership. It names 0x5c30d0a9…3de64b and 0xee5797EC…523cC5 as the addresses involved, and says IVY was sold in sixteen transactions worth 234,361 USD without saying which address made those sales. It puts the total loss at 1,820,319 USD, lists the liquidity removal as 0x86761605…6d60ec and names 0xcE97bEb4…89c40a as the address holding the resulting USDT.

How it happened

  1. The constructor creates the IVY/USDT pair and credits the whole 100,000,000 IVY supply to the hard-coded address 0x7EB72F4a…07493D. It sets 0xCaE04f38…00d5cc as fundAddress and exempts both addresses from fees.
  2. _transfer rejects any transfer from a blacklisted address, and only the owner can call setBlackList. A listed holder cannot send tokens at all, including selling them.
  3. The sell fee is (_sellFundFee + _sellLPDividendFee + _sellLPFee) / 10000 of the amount, and the owner can set each part to any value. At a total of 10000 a sale delivers nothing to the pair. Above 10000, tAmount - feeAmount underflows and the sale reverts.
  4. closeTrade() resets startTradeBlock to 0. closeAddLP() also sets startAddLPBlock to 0. With both at 0, every non-whitelisted buy or sell through the pair fails with !startAddLP.
  5. The owner-only controls in steps 2 to 4 stop working once ownership is renounced; owner() reads zero today. onlyFunder functions also accept fundAddress, so the fund address can still whitelist addresses from fees, add or remove addresses as pairs, change the fund address, and withdraw any token held by the contract with claimToken.
  6. None of these switches is needed to drain the pool. CertiK reports that the EOA 0x5c30... removed about $1.58 million of liquidity, which caused the price to drop by more than 94%.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract IVY

Evidence

Same attack technique

Browse all hacks →
SOMESING $167K lost Openfabric AI $59K lost 2049 $82K lost Bitcoin BSC $36K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes