Keep3rX.finance Rug Pull

Reported loss $2K
Ethereum
Rugpull

What happened

Keep3rX.finance (KPX) is an owner-controlled token whose source contains a mint function named upgrade. It is restricted to the owner, credits the new tokens to the owner's balance and, unlike a normal mint, does not increase _totalSupply. The contract also has an owner-managed user mapping that blocks listed addresses from sending tokens.

Per Etherscan, the deployer address 0xC55EF0CB…4E7fBf added 30 ETH and 100,000 KPX to Uniswap V2 on 2020-11-02 (tx 0x68aa5724…210eab). On 2020-11-05 the same address called upgrade to mint 500 million KPX (tx 0x3083ae1e…752520) and 42 seconds later swapped all 500 million KPX for about 31.99 ETH on Uniswap V2 (tx 0x80e4a041…5e9a5a). De.Fi's REKT database lists the incident as an Exit Scam/Rugpull with a 1,813 USD loss.

How it happened

  1. The constructor sets _totalSupply = 100000 * 10**18; and credits it all to the deployer (_balances[msg.sender] = _totalSupply;), which makes the deployer the Ownable owner.
  2. The owner-only function upgrade(uint256 amount) calls _upgrade(_msgSender(), amount), which runs _balances[account] = _balances[account].add(amount); and emits a Transfer from the zero address. It never touches _totalSupply, so minted tokens do not show up in totalSupply().
  3. On 2020-11-02 the deployer paired 30 ETH and 100,000 KPX in a Uniswap V2 pool, so the pool's ETH side was the only real value behind the token.
  4. On 2020-11-05 the deployer called upgrade to mint 500 million KPX to itself, about 5,000 times the original 100,000 supply.
  5. Seconds later the deployer swapped the 500 million KPX through Uniswap V2 Router 2 and received about 31.99 ETH, draining most of the pool's ETH.
  6. Separately, the owner can call addUser(address[] memory account) to set user[account[i]] = true;, and _transfer starts with require(!user[sender], "error");. A listed address cannot send tokens, including through a router sale, because sender is the holder whose tokens move. Etherscan shows no addUser call in the transactions reviewed here, so the block is something the code allows, not something shown to have been used.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract KPX
Protocol links Website @keep3rxfinance

Evidence

Same attack technique

Browse all hacks →
Ethereum YFFC $72K lost Ethereum Bloody Finance $1K lost Ethereum Groot.finance $4K lost Ethereum Kper Network $542K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes