Magic Rug Pull

Reported loss $47K
Rugpull

What happened

Magic (Magic) is a BNB Smart Chain token whose owner keeps broad control after launch. The contract lets the owner mint new tokens to their own address, burn tokens from any holder's balance, blacklist any address so it cannot send or receive, and pause all transfers. De.Fi's REKT database lists the project as a rug pull with about $47,315 taken, and records that tokens were swapped for 8,485.69 USDT (BSC-USD).

De.Fi's listing gives these addresses and transactions:

The verified source shows the whole 10,000,000 supply is credited to the deployer in the constructor, so the deployer starts holding all tokens before any pool exists. The code does not show who supplied or removed liquidity, and the transactions above could not be opened, so the movement of funds is attributed to De.Fi's listing only.

How it happened

  1. At deployment the constructor credits the whole supply to the deployer: _balances[msg.sender] = _totalSupply; with _totalSupply = 10000000 * 1e18. The deployer, 0xfAe915e7…06F995, is also the owner (owner still reads 0xfae915e7…06f995 on-chain), so one address holds all tokens and every admin power.
  2. The owner can create more supply at will: function mint(uint256 amount) public onlyOwner { _mint(_msgSender(), amount); }. There is no cap and the new tokens always go to the owner. An owner can also reduce any holder's balance: function burn(address account, uint256 amount) public onlyOwner { _burn(account, amount); }.
  3. Transfers can be shut off per address or for everyone. _transfer starts with require(!isBlackListed[sender] && !isBlackListed[recipient],"blacklisted");, so a blacklisted holder cannot sell (the holder is sender) and a blacklisted pair cannot receive or send; addBlackList(address _evilUser) public onlyOwner sets the flag. pause() is onlyOwner and _beforeTokenTransfer is whenNotPaused, which stops every transfer.
  4. Trades through the recognised pairs (RLT or USDT pairs on BitbyteSwap or PancakeSwap, plus any pair the owner adds with addOtherSwapPair) pay a fixed 2% burn and 4% fee: the sender is debited the full amount, the recipient receives amount minus both fees, and the 4% goes to lpFeeTo, which the owner can change with setFeeTo. The rates are constants (burnRate = 2 * 1e16, lpFeeRate = 4 * 1e16), so this is a trading tax rather than a sell block.
  5. All the powers above can be given up by the owner through renounceOwnership(), but nothing in the contract forces this, and the owner address is unchanged on-chain.
  6. What happened, per De.Fi's REKT database: tokens were swapped for 8,485.69 BSC-USD, tokens were minted to 0xfae915e7…06f995 and moved through three further addresses, and about $47,315 was taken in total. Whether the owner mint function was called, and how the liquidity was removed, is not shown by the source and the BscScan transactions could not be opened.

Protocol details

Classification Other
Protocol Type Exit Scam/Rugpull
Affected asset / contract Magic

Evidence

Same attack technique

Browse all hacks →
BreedTech $9.4M lost Sport Move $160K lost SHIDAO $180K lost DecentraWorld $1.0M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes