Kper Network Rug Pull

Reported loss $542K
Ethereum
Rugpull

What happened

Kper.network (KPER) was an Ethereum token modelled on the Keep3r codebase in which a single governance address can mint any amount of new tokens to itself through mint(uint amount), with no cap. Shortly after deployment on 2020-10-29, the deployer used setGovernance to nominate the external address 0x01186BdC…20AF33. Two days later, on 2020-10-31, that address minted 10,000,000 KPER and within a minute sold 10,005,000 KPER into the Uniswap V2 pool for about 1,387.76 ETH.

It later minted another 10 trillion KPER and sold 10,000 more for about 17.66 ETH. De.Fi's REKT database lists the token as an exit scam/rug pull.

How it happened

  1. The constructor sets governance = msg.sender, and mint is gated only by require(msg.sender == governance, "mint: !gov") before crediting _mint(governance, amount) with no supply limit.
  2. On 2020-10-29 the deployer called setGovernance with 0x01186BdC…20AF33 (tx 0xecaf79cf…5ede79). Because setGovernance only sets pendingGovernance, that address then had to call acceptGovernance to become governance.
  3. On 2020-10-31 16:57 UTC the new governance address called mint for 10,000,000 KPER (tx 0x138d8e6a…94b3e1).
  4. At 16:58 UTC it swapped 10,005,000 KPER for about 1,387.76 ETH through Uniswap V2 Router 2 (tx 0xb4a01b32…a042d6).
  5. At 18:12 UTC it minted 10 trillion more KPER (tx 0x47f53a6a…48b29c) and at 18:13 UTC sold 10,000 KPER for about 17.66 ETH (tx 0xa4bd2c5b…ce57e1).

Protocol details

Classification Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract KPER
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Ethereum Keep3rX.finance $2K lost Ethereum Groot.finance $4K lost Ethereum SuperMarioBros $10K lost Ethereum Foxy.farm $6K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes