LV Metaverse Rug Pull

Reported loss $1.5M
Rugpull

What happened

LV PLUS (LVP) was the token of the LV Metaverse project on BNB Chain, deployed on 13 June 2022 at 0x5927b724…9063fc by 0x77210347…a3b167, with a supply of 6,000,000,000,000,000 LVP minted to the owner. On 21 June 2022 wallets that had received tokens from the deployer side sold them on PancakeSwap and crashed the price; CertiK put the loss at about $1.5 million, with wallet 0x1e156e7b…4fa6a6 dumping about $1,031,847 and 0x9730bc19…0f1f03 about $335,061. That second address is hard-coded in the contract as liquidityAddress, which receives 5% of every buy.

De.Fi's REKT database lists five receiving wallets: 0x1e156e7b…4fa6a6, 0x9174297d…4b932b, 0x9730bc19…0f1f03, 0x4d115818…b0b4e0 and 0x2c48ba8e…10d1da. The code also gave the owner a blacklist, uncapped fee setters, and a contractEnabled switch that is off at deployment and makes every sale by a non-exempt holder revert.

How it happened

  1. The constructor creates the PancakeSwap pair, marks the owner and the contract as fee-exempt, and mints the whole totalSupply_ = 6000000000000000 * 10**18 to the owner with _cast(owner(), totalSupply_).
  2. Buys pay _liquidityFee (5%) to liquidityAddress = 0x9730Bc1939Faae571c601Bb5222839626b0f1f03; sales into the pair pay _burnFee (27% by default) to the dead address.
  3. For holders who are not fee-exempt, _swapLimit runs if(isContract(to)) { require (contractEnabled, "can not transfer to contract address"); }. The pair is a contract and contractEnabled starts as false, so their sales revert until the owner calls setContractEnabled(true). Exempt wallets skip this check.
  4. setBlack and setMultipleBlackList let the owner block any address as sender or recipient, and setBurnFee, setTaxFee and setLiquidityFee have no upper bound. setEthWith and setErc20With let the owner withdraw BNB or any token held by the contract.
  5. De.Fi's REKT database lists transaction 0xb2fca71b…64c307 as the deposit through which the dumping wallet received its tokens from the contract deployer side, and transfers to 0x1e156e7b…4fa6a6 in 0x9494749d…32ac23 and 0xca877351…36e8e0, and to 0x9174297d…4b932b in 0x2f58f02d…b1efd0.
  6. According to CertiK, about $1.5 million was extracted on 21 June 2022 when five wallets that received LVP from the deployer side, including 0x1e156e7b…4fa6a6 and 0x9730bc19…0f1f03, sold into the pool for BUSD and sent the proceeds to an aggregation wallet that also held proceeds from other rug pulls. De.Fi's REKT database gives 0xc3b7e155…59a805, 0x35efcc3e…9a64f3, 0x3c28da5f…37cbb1 and 0xf6855384…a89d48 as example dump transactions, and lists 0xb2fca71b…64c307 among them as well.

Protocol details

Classification Gaming / Metaverse
Protocol Type Exit Scam/Rugpull
Affected asset / contract LVP
Protocol links Website @LV__Metaverse

Evidence

Same attack technique

Browse all hacks →
BabyDAO $8K lost Dark Light $134K lost DHE $142K lost BabyElon $53K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes