Iwr token Rug Pull

Reported loss $34K
Rugpull

What happened

Iwr token (IWR) is a BNB Chain token deployed on 11 April 2023 at 0xB9934562…DcbFda by 0x1e3ab5c4…08e244, which is still its owner. Its owner can set the buy and sell taxes to any value with no cap, blacklist any address, and set a kill window during which every token bought from the pair is sent to the owner's address instead of the buyer. A sell tax above 100% makes every taxed sale revert, and a tax of exactly 100% credits none of the sold tokens to the pair, so the swap has nothing to sell.

CertiK reported on 12 April 2023 that a high sell tax prevented holders from selling and that the deployer removed about $34,000 from the liquidity pool. De.Fi's REKT database lists the liquidity removal transactions as 0x3f1b412d…e599b9 and 0x17d54b1e…8838c6, and says the deployer also sold tokens and the price fell by about 90%.

How it happened

  1. The constructor credits the whole supply to the owner argument and creates a pair against the usd token; the owner and the contract are excluded from fees and from the transaction and wallet limits.
  2. setSelTaxes and setBuyTaxes are onlyOwner and store any value with no upper bound, and setSellDestFee / setBuyDestFee add a further uncapped burn fee.
  3. On a sale, _transfer first debits the seller's full amount, then takeFee computes amount.mul(_totalTaxIfSelling.sub(_sellDestroyFee)).div(100) and returns amount.sub(feeAmount.add(destAmount).add(airdropAmount)). A total above 100% underflows and reverts the sale; exactly 100% sends the whole amount to the contract as fee and credits the pair with zero tokens.
  4. multipleBotlistAddress lets the owner flag any list of addresses, and _transfer reverts when the sender or the recipient is flagged, so a flagged holder cannot sell or move tokens.
  5. setKing sets kill with no limit; for kill blocks after liquidity is first added, every transfer out of the pair is redirected with _basicTransfer(sender, receiveAddress, amount), so buyers pay but the tokens go to the owner.
  6. CertiK reported that a high sell tax stopped holders from selling and that the deployer removed about $34,000 from the pool.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract IWR

Evidence

Same attack technique

Browse all hacks →
Hepton token $73K lost ChainGPT $82K lost Theory Craft Fames $69K lost XCAD $100K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes