Kickboxer Tate Rug Pull

Reported loss $33K
Rugpull

What happened

Kickboxer Tate (KBTate) is an ERC20 on Uniswap V2 in the Ethereum network, deployed on 2023-04-30 by 0x188602fb…0e17B4. Its verified source looks like a standard fee token, but it adds an external SwapBacks(account, value, deadline) function with no onlyOwner check. When the caller is fee-exempt, which the constructor makes true for the hard-coded marketingAddress 0xC7E90f04…3f6a83 and devAddress 0x753bD509…8836B0, the function burns value tokens from any account, including the Uniswap pair, or overwrites the excluder value that sell checks compare against. Burning the pair's tokens and then calling sync() leaves the pool with almost no tokens against all its ETH.

Etherscan shows this sequence on 2023-05-04 from 0xC7E90f04…3f6a83: a SwapBacks call at 06:36:23 UTC that burned 295.23 million KBTate from the pair (tx 0xf8e69e12…0ea3e8), a SwapBacks call with value 0 and a very large deadline at 06:36:35 UTC (tx 0x5e2f431a…d7611b), a pair sync() at 06:37:11 UTC whose Sync event reports reserves of 1,679,858,554,702,087,344 and 17,442,278,716,106,290,643 (raw, 18 decimals) (tx 0x67af84e5…7af79c), and a swap at 06:37:35 UTC that sold 8,999,979 KBTate for 17.44 WETH (tx 0x16da62cb…990a23). At 07:03:35 UTC the same address sent 17.88 ETH to 0x753bD509…8836B0 (tx 0x7232389e…128ed9). PeckShield's alert reports that 0xC7E9...a83 had bought 38 million KBTate with 0.25 ETH, that the dump was worth about 33,000 USD, and that 0x753b...6B0 had received 1.7 ETH from the deployer. The alert's one-sentence summary is that the token dropped 100%.

How it happened

  1. The constructor hard-codes two wallets and exempts them from fees: marketingAddress = address(0xC7E90f04cD17784cC3643Bd94EBd3582A53f6a83);, devAddress = address(0x753bD509786ccfad5c7957b282C71cB4578836B0);, excludeFromFees(marketingAddress, true); and excludeFromFees(devAddress, true);. The exempt flag lives in _isExcludedFromFees and has no setter that works without an owner, so it survives renounceOwnership (the owner reads as the zero address on 2026-09-30).
  2. SwapBacks is external with no access modifier. After requiring the contract to hold at least swapTokensAtAmount fee tokens, it calls contractSwapTokens, whose branch for a fee-exempt msg.sender runs _burn(account, value); for any account the caller names. Pointing account at the Uniswap pair removes tokens from the pool's balance without touching its stored reserves.
  3. Anyone can call the pair's sync(), which rewrites the reserves to the pair's real balances. With the token side burned down, the pool prices KBTate at nearly the whole ETH side, so selling a small amount of tokens withdraws almost all of the pool's ETH.
  4. The same branch has a second control: with value == 0 it runs excluder = deadline;. The transfer-delay check for sells requires userBalance[from] > excluder for non-exempt holders, so a very large deadline can make normal holders' sells revert while transferDelayEnabled is true.
  5. What happened on 2023-05-04, from Etherscan: 0xC7E90f04…3f6a83 called SwapBacks burning 295.23 million KBTate from the pair, called SwapBacks with value 0 and a very large deadline, called sync(), sold 8,999,979 KBTate for 17.44 WETH, and sent 17.88 ETH to 0x753bD509…8836B0.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract KBTate

Evidence

Same attack technique

Browse all hacks →
Linda Yaccarino $375K lost DerpMan $88K lost GN $96K lost Ordinals Finance $1.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes