Jester DeFi Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

Jester DeFi's token contract gives its operator several switches over holders: a one-way trading switch, a transfer-size cap that can be set to almost nothing, and a per-address blacklist that stops listed holders from sending tokens. De.Fi's REKT database lists Jester DeFi (JEST) as an Exit Scam/Rugpull dated 2021-08-30 on BNB Chain, with no loss figure. The farm contract at 0x9B7Cf9EC…5DbB9E was deployed on 2021-06-29 by 0x9d7C7375…E1d879, the same address shown in De.Fi's proof link.

The code shows what the operator can do; no transaction was opened that shows any of these functions being called.

How it happened

  1. JesterToken starts with bool private isTradeEnabled = false;. In antiWhale, a transfer where neither the sender nor the recipient is excluded runs require(isTradeEnabled,"JESTER::transfer: You cannot make transactions yet");. Only the deployer, the zero address, the token and the burn address are excluded at construction, so ordinary holders cannot transfer until the operator calls enableTransaction(). That function only sets the flag to true.
  2. The same modifier then runs require(amount <= maxTransferAmount(), ...), with maxTransferAmount() equal to totalSupply().mul(maxTransferAmountRate).div(10000). updateMaxTransferAmountRate only checks _maxTransferAmountRate <= 10000, with no minimum, so the operator can set a rate such as 1 (0.01% of supply) and make larger transfers by non-excluded addresses revert, or set 0, which makes maxTransferAmount() > 0 false and skips the whole check.
  3. _transfer starts with require(_blackList[sender] == false,"JESTER::transfer: You're blacklisted");, and transferFrom calls _transfer(sender, recipient, amount) with the holder whose tokens are moved as sender. The operator can call addToBlackList(_account, true) to stop that holder from sending, including selling through a router; receiving is not blocked. A blacklisted pair address would block transfers out of the pair, which are the buy side of a swap.
  4. The farm lets its owner postpone rewards: updateStartBlockHarvest(uint256) and updateHarvestTime(uint256) are onlyOwner with no bounds, and payOrLockupPendingJester only pays when block.number >= startBlockHarvest && block.number <= lastBlockHarvest; otherwise rewards are added to user.rewardLockedUp. withdraw and emergencyWithdraw still return staked LP tokens via pool.lpToken.safeTransfer(address(msg.sender), _amount);.
  5. What happened: De.Fi's REKT database lists the project as an Exit Scam/Rugpull on 2021-08-30. The BscScan proof page could not be read, so which of these functions were used, and any amount lost, are not established here.

Protocol details

Classification Yield Aggregator
Protocol Type Exit Scam/Rugpull
Affected asset / contract JEST
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
BNB Chain CatgeSwap Loss not disclosed Polygon Hippolygon Loss not disclosed BNB Chain Haikyu Loss not disclosed Polygon Glockswap Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes