King Tribe Rug Pull

Reported loss $997K
Rugpull

What happened

King Tribe's KTB is a BNB Chain token deployed on 2 October 2022 at 0x7696c8BC…1B45F5 by 0x2015Ca29…fd202d, which is still its owner. Its buy path contains if (_isBlackOpen) blacklist[recipient] = true;, and _isBlackOpen starts as true, so every ordinary wallet that buys from the pool is added to the blacklist, and any later sale, or transfer to a non-exempt address, from that wallet reverts. The owner and fee-exempt addresses skip the blacklist check entirely, and the owner can switch the auto-blacklist off, edit individual entries and set fees with no cap.

De.Fi's REKT database, whose proof link is a CertiK alert, says several EOAs that received KTB from the deployer drained the PancakeSwap pool, the price fell more than 95%, and about $997,086 was collected at 0x36e39ce8…a2814b and sent on to an address labeled mexc.com, 0x4982085c…6e89cb, with the last transfer on 18 November 2022. The listing names these scammer addresses: the deployer 0x2015ca29…fd202d, 0xca13add7…a4cbce, 0x87b89a7e…2ba72d and 0x9b629e1a…b798ff. It cites three token distribution transactions from the deployer:

How it happened

  1. The constructor mints 310,000,000 KTB (9 decimals) to the deployer, creates the pair and marks the deployer, the token contract, the dead address, the NFT dividend address and the funds address as fee-exempt.
  2. In _transfer, fee-exempt senders or recipients go straight to super._transfer. Everyone else must pass require(!blacklist[from] && !blacklist[to], ...).
  3. A buy (from == swapPair) runs _buyWithFee, whose first line is if (_isBlackOpen) blacklist[recipient] = true;. With the default bool private _isBlackOpen = true;, the buyer is blacklisted in the same transaction that delivers their tokens.
  4. When that buyer later sells or sends tokens to a non-exempt address, the blacklist check on from reverts.
  5. A wallet that receives KTB directly from the fee-exempt deployer has never bought from the pool, so it is not blacklisted and can sell into the pool through _sellWithFee. De.Fi's listing says the wallets 0xca13add7…a4cbce, 0x87b89a7e…2ba72d and 0x9b629e1a…b798ff received KTB from the deployer (0x9f45aa5e…242863, 0x0999d3b1…619fe2, 0x87762d7b…70b342) and drained the pool, with the proceeds gathered at 0x36e39ce8…a2814b and sent to 0x4982085c…6e89cb.
  6. The owner can also call setIsBlackOpen, setBlacklist and setSwapFees; the last has no upper bound, and fees totaling more than 100% make amount.sub(feeTotal) revert.

Protocol details

Classification Token / NFT
Protocol Type Exit Scam/Rugpull
Affected asset / contract KTB
Protocol links Website @KingTribe_Defi

Evidence

Same attack technique

Browse all hacks →
SCAT $26K lost DeFi Safe $127K lost GDAO $90K lost LOO $275K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes