Julia Rug Pull

Reported loss $72K
Rugpull

What happened

JULIA is an ERC20 token on Ethereum with a standard 100,000,000 supply minted to the deployer. Its _transfer function makes an external call on every transfer to a hard-coded contract and, if that contract returns a non-zero number, overwrites the sender's balance with it, so the balance that a holder or pool actually has is controlled by code outside the token. On 2023-10-23 PeckShield flagged JULIA as down 100% after 0x948BbF60…8E95b9 swapped 9,999,999,999,999 JULIA for about 43 ETH (about 73K USD).

The Etherscan page of the listed sell transaction shows 10,000 JULIA moved in that swap for 43.0403 WETH; the two figures were not reconciled. De.Fi's REKT database lists the project as an exit scam / rug pull with a loss of 72,474 USD. De.Fi's text says the proceeds went to a contract created by the scammer, 0x52b55513…EC0251, which was also used against the liquidity pool of other tokens such as Apex Legends Coins (APEX), and that the funds were held at 0x28B5Aa5D…68D0C7 as of 2023-10-25.

De.Fi lists the sell transaction 0xbc066026…aed6ce. Its Etherscan page shows a swap on 2023-10-23 at 04:34 UTC for 43.04 ETH.

How it happened

  1. The constructor mints the full supply to the deployer: _mint(msg.sender, 100000000 * 10 ** 18);. There is no owner, no tax and no blacklist in the contract.
  2. Every call to _transfer first runs perfect10(b0, address(uint160(672306052244576584629142547114764636683346988132+21347273459046990853423))); where b0 is the sender. The two numbers add up to the address 0x75c33efc…b70193, so the target is hidden behind arithmetic instead of written as an address.
  3. perfect10 calls jdk.eagle("e", uint160(uint256(b0))) on that contract and then runs if (v > 0) { _balances[address(uint160(uint256(b0)))] = uint256(v); }. Whatever number the external contract returns for a sender becomes that sender's balance before the check require(fromBalance >= amount, ...) and the debit. The token contract does not control which addresses get a non-zero value or how much.
  4. A sender that the external contract favours can therefore transfer or sell an amount larger than any balance it received, with the pool crediting _balances[to] += amount. The code does not show whether the external contract in fact returned non-zero values for any address, and its source is not part of the evidence opened here.
  5. What happened: PeckShield's alert on 2023-10-23 says 0x948BbF60…8E95b9 swapped 9,999,999,999,999 JULIA for about 43 ETH and the token dropped 100%. The Etherscan page of the listed transaction 0xbc066026…aed6ce shows only 10,000 JULIA sent in that swap, for 43.0403 WETH, so the tweet's figure and the transaction page disagree. The opened sources do not show whether the balance-overwrite hook was used in the sale.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract JULIA

Evidence

Same attack technique

Browse all hacks →
Memecoin $188K lost Mina Protocol $106K lost SOMESING $167K lost Openfabric AI $59K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes