Lets Go Farming Token Rug Pull

Reported loss $37K
Rugpull

What happened

Lets Go Farming Token (LGF) is a reflection token deployed on Ethereum on 30 November 2021 at 0x4EadbFE0…a802d3 by 0x676E7101…1943cD, which is still its owner. The owner can block any holder except the pool and router with addSniper, can set the per-transaction limit to zero with setMaxTx so that no one but the owner can transfer, and can raise buy and sell fees to as much as 50%. The contract also has a lock/unlock pair that can make ownership look renounced while letting the previous owner take it back.

The deployer withdrew its liquidity from the Uniswap V2 pool through the router in three transactions: 9.00 ETH on 2 December 2021 (0xafe7831d…15268b), 1.97 ETH on 5 December 2021 (0x02416cd4…390cd3) and 24.35 ETH on 4 October 2022 (0xd2531214…a2285f), about 35.33 ETH in total. De.Fi's REKT database lists this as an exit scam dated 4 October 2022, with a loss of 29.32 ETH, about 37,265 USD.

How it happened

  1. The Ownable constructor makes the deployer the owner, and the LGF constructor gives it the whole 1 trillion LGF supply and marks it as a liquidity holder. Liquidity added by the contract's own swapAndLiquify is minted to owner() as LP tokens.
  2. addSniper(address) is onlyOwner and can target any address except the pair and router. _transfer then rejects the address as sender, recipient or caller with require(!_isSniper[from], "ERC20: snipers can not transfer"), which works as a blacklist.
  3. setMaxTx(uint256 maxTx) has no lower bound. Because _transfer requires amount > 0 and, for any transfer not involving the owner, amount <= _maxTxAmount, a limit of zero would stop every holder from selling or moving tokens.
  4. The fee setters accept 1 to 25 each for the tax and liquidity fee on buys and sells, so a trade can cost up to 50% (the defaults are 10% on buys and 10% on sells).
  5. lock(uint256 time) sets _owner to zero while saving _previousOwner, and unlock() restores it after the time passes, so a zero owner does not prove the powers above were given up. The owner also has upgradePair and sweep, which can move the pair to an Empire DEX sweepable pair and pull its WETH to owner().
  6. What happened on-chain did not need these functions: the deployer called removeLiquidityETHWithPermitSupportingFeeOnTransferTokens on the Uniswap V2 router three times, withdrawing 9.00, 1.97 and 24.35 ETH, the last on 4 October 2022.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract LGF

Evidence

Same attack technique

Browse all hacks →
FlokiChain $111K lost The Micro Elements $573K lost NWN $110K lost e-STD $49K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes