LK-99 Protocol Rug Pull

Reported loss $152K
Rugpull

What happened

LK-99 Protocol (LK99) was an Ethereum token deployed on 1 August 2023 during the LK-99 superconductor hype, paired with WETH on Uniswap V2. Its constructor gives the whole 100,000,000 supply to the deployer, who also held the pool's LP tokens. The code adds a hidden per-address transfer block: the owner-only Execute function sets a "cross amount" for any list of wallets, and a wallet with a cross amount can only send more than that amount, so setting it above a holder's balance freezes every transfer and sale from that wallet.

Between 3 and 7 August 2023 the deployer removed liquidity from the pool in four removeLiquidityETHWithPermit transactions. De.Fi's REKT database puts the loss at 82.78 ETH, or 151,735 USD, and lists 0x72070ebe…f30238 as holding the funds on 8 August 2023.

How it happened

  1. The constructor mints the full supply to the deployer: _balances[owner()] = _balances[owner()].add(_totalSupply); with _totalSupply = 100000000 * 10**_decimals.
  2. Execute(address[] accounts, uint256 amount) can only be called by the owner and writes _crossAmounts[accounts[i]] = amount for every listed wallet.
  3. _transfer reads cAmount(sender) and, if it is non-zero, runs require(amount > crossAmount, ...). The check is on the sender, so it covers direct transfers and router sales alike. A cross amount above the wallet's balance makes every transfer from that wallet revert, while buys from the pair are unaffected.
  4. owner() is still the deployer, so this power has not been given up. No source opened here shows Execute being called.
  5. The deployer, holding the LP tokens, called removeLiquidityETHWithPermit on the Uniswap V2 router four times between 3 and 7 August 2023, taking the pool's WETH as ETH and the LK99 side back to its own wallet.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract LK99

Evidence

Same attack technique

Browse all hacks →
BitLord $566K lost Tommy VICE CITY $308K lost Satori $226K lost Majin Buu $168K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes