LOO Rug Pull

Reported loss $275K
Rugpull

What happened

LOO is a BEP20 token on BNB Smart Chain (contract 0xfDB0fE3d…5659ab) traded against USDT on PancakeSwap. The deployer-owner receives the whole 21,000,000,000 supply at deployment and keeps an owner-only blocklist (multipleBotlistAddress) that makes any transfer to or from a listed address revert, plus uncapped buy and sell fee setters and a settable fee-destination wallet. CertiK's Skynet alert of October 28, 2022 (23:32 UTC) reported an exit scam with slippage above 97%: the deployer sent more than 1B LOO to 0x36ec9..., which sold for a profit of roughly $269K.

De.Fi's REKT database lists the loss as $275,117 and says the deployer sent 1,050,000,000 LOO to an EOA that drained the liquidity, and that the proceeds were then moved to another EOA. The addresses it lists are 0xd9c37a0a…a43194 (the deployer), 0x36ec92f4…324d6a and 0xf88e124b…6c67b4, with token-transfer transaction 0xe5c67dff…b5aecd and stolen-funds transfer 0xed08f931…aeac5c. The sale needed no special backdoor: the deployer held the supply and the pair was a normal PancakeSwap pool.

How it happened

  1. At deployment _mint(owner(), totalSupply) creates 21,000,000,000 LOO for the deployer, excludeFromFees(owner(), true) exempts the deployer from fees, and the constructor creates the LOO/USDT pair on the PancakeSwap router.
  2. The owner can block addresses: function multipleBotlistAddress(address[] calldata accounts, bool excluded) public onlyOwner writes _isBlacklisted, and _transfer enforces require(!_isBlacklisted[from] && !_isBlacklisted[to], 'Blacklisted address');. A listed holder cannot sell (the holder is from when the router pulls tokens into the pair), and a listed pair would block all trading. No source shows this was used.
  3. The owner can raise fees without limit: setBuyTaxes and setSelTaxes take unbounded values. On a sell, MFee = amount.mul(sellMarketingFee1).div(100) and DFee = amount.mul(sellDeadFee).div(100) are both debited from the seller, so a combined 100% leaves the seller nothing, and a higher total makes amount.sub(fees) revert. setDeadWallet also lets the owner redirect the DFee share, labelled a burn, to any address, and setMarketingWallet changes where the swapped marketing share goes. Renouncing ownership would remove these powers, and the contract has renounceOwnership, but the on-chain owner read on 2026-09-30 was still the deployer.
  4. What was reported: per CertiK, the deployer sent more than 1B LOO to an EOA beginning 0x36ec9..., which sold into the pool for about $269K and caused slippage above 97%. De.Fi lists the loss as $275,117 and the transfer of proceeds to another EOA.
  5. The code charges no fee on the first hop. A plain transfer between two non-contract addresses hits if(!automatedMarketMakerPairs[to] && !automatedMarketMakerPairs[from] && !isContract(from) && !isContract(to)){ and sets fees = 0, whether or not the sender is fee-exempt. Only the later sale into the pair falls under the sell branch if(automatedMarketMakerPairs[to]){, where the fee applies unless the seller is in _isExcludedFromFees. The source alone does not show whether the receiving EOA was fee-exempt or how the pool's liquidity was funded.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract LOO

Evidence

Same attack technique

Browse all hacks →
King Tribe $997K lost GDAO $90K lost A6 Token $61K lost DDCX $148K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes