Marvel Metauniverse Rug Pull

Reported loss $94K
Rugpull

What happened

Marvel Metauniverse (MRV, contract 0x706BABd2…F624BF) is a BEP-20 token on BNB Smart Chain that De.Fi's REKT database lists as a rug pull of 93,746 USD on 2022-08-28. The listing says the MRV price fell more than 92% on PancakeSwap after an owner-related address sold aggressively, and that the owner had first moved already-minted tokens to an externally owned account that then started selling. The verified source credits the entire fixed supply of 96,000,000 MRV to a constructor-supplied tokenOwner that is also exempt from trading fees, and gives the contract owner switches that can stop other holders from selling or sending; whether those switches were used is not shown by any transaction opened here.

Addresses and transactions named in the De.Fi listing:

How it happened

  1. The constructor credits the whole fixed supply to the tokenOwner argument and exempts that address from fees: _rOwned[tokenOwner] = _rTotal; and _isExcludedFromFee[tokenOwner] = true;. _owner = msg.sender makes the deployer the contract owner. No function mints more tokens.
  2. A fee-exempt sender or recipient bypasses all sell logic: if(_isExcludedFromFee[from] || _isExcludedFromFee[to] || _destroyMaxAmount <= balanceOf(_destroyAddress)){ _tokenTransfer(from, to, amount, false);. A supply holder selling into uniswapV2Pair therefore skips both the sell fee and the sell switch below, and the owner can exempt further addresses with excludeFromFee.
  3. Every other holder selling into the pair passes }else if(to == uniswapV2Pair){ require(swapSellStats);, and the owner can flip that flag at any time with function changeSwapSellStats() public onlyOwner { swapSellStats = !swapSellStats; }. The owner can also stop a chosen address from sending at all: function excludeFromVip(address account) public onlyOwner sets the flag that require(!_isExcludedFromVip[from]); checks at the top of _transfer.
  4. Fees are capped, not open-ended: require(_BuyRate <50 && _SellRate <50 && _transferRate <50,"do not more than 15"); limits the sell fee to at most 14.7% of the amount, and the seller's balance is debited the full amount (_rOwned[sender] = _rOwned[sender].sub(rAmount);) with the recipient credited the remainder.
  5. What happened, per De.Fi's listing: tokens were moved from the owner to an externally owned account, that account sold into the MRV pool, the price fell more than 92% and 93,746 USD was drained. The code allows this sequence for a fee-exempt holder without any switch being flipped.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract MRV

Evidence

Same attack technique

Browse all hacks →
Meta Magic Coin $62K lost Carillonium $59K lost GMT $12K lost World Cup $132K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes