LightLink token Rug Pull

Reported loss $65K
Rugpull

What happened

This LightLink token (LL, BNB Smart Chain contract 0x44CE3a2e…aB3fD9) is a BEP20 token deployed on 2023-03-17, and CertiK's alert says not to confuse it with projects of a similar name. Its code blocks wallet sells by default: a canSell flag starts false and only a stored token-owner address can flip it, so any sale into the pool reverts with canSell until that address allows it. The token-owner address, the contract creator and the contract itself are excluded from that check.

On 2023-03-18 CertiK Alert reported a large liquidity removal on the token, with the deployer taking about 65,000 USD from the pool, and described the token as appearing to be a honeypot. De.Fi's REKT database lists the price as dropping about 90% after liquidity was removed and tokens were sold.

Deployer: 0x04fe6903…72cac1 Example liquidity removal transaction: 0xef47fcb2…f737dd

How it happened

  1. The constructor creates a pool against BSC-USD, mints 100,000,000 LL to tokenOwner, and excludes tokenOwner, the owner and the contract from fees.
  2. canSell is a plain bool that defaults to false. changeCanSell flips it and requires _tokenOwner == msg.sender; _tokenOwner has no setter. renounceOwnership only clears _owner, so it does not remove this switch.
  3. In _transfer, a sale (to == uniswapV2Pair) from a non-excluded wallet hits require(canSell,"canSell") and reverts while the flag is false. Wallet-to-wallet transfers hit the same check. Buys (from == uniswapV2Pair) skip it, take a 5% burn, and pass.
  4. The owner-side maxSellToken sets a cumulative sell cap per address, enforced by require(_maxSell[from] >= _haveSell[from].add(amount), "maxSell"), so a small cap blocks further sells by that wallet even when canSell is true.
  5. When tokens are sent to the pool in a way that looks like adding liquidity, require(_tokenOwner == from) means only the token owner can add liquidity. The excluded token-owner address is not subject to the canSell check.
  6. What happened, per CertiK Alert: the deployer removed about 65,000 USD from the pool and the token appears to be a honeypot. The sources opened do not show whether canSell was ever switched.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract LL
Protocol links Website @LightLinkChain

Evidence

Same attack technique

Browse all hacks →
APPLE $30K lost SpaceID $33K lost ChainGPT $43K lost Block Chain Games $40K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes