Mercenary Rug Pull

Reported loss $760K
Rugpull

What happened

Mercenary Gold (MGOLD) is an unmodified OpenZeppelin ERC20PresetMinterPauser deployed on BNB Smart Chain. The deployer receives the admin, minter and pauser roles, the constructor mints nothing, and mint has no cap, so any supply that exists was created later by an account holding MINTER_ROLE. That account can create unlimited tokens and sell them into the PancakeSwap pool, which dilutes and drains every other holder, and the pauser can freeze all transfers.

On 2022-01-26 PeckShield Alert posted that MGOLD on BSC had rugged and that the deployer drained more than 760,000 USD. De.Fi's REKT database lists the same event as an exit scam / rug pull, and its record cites the following transactions: a liquidity removal 0x53deb909…4234c7, minting transactions 0xbdd7c46c…a1318a and 0xabc092e8…3e2626, and sales 0xd219f3e0…9513c1, 0x9b27635b…5cd918 and 0x80ffb26c…b2ba91. The explorer pages could not be opened, so these transactions are credited to the De.Fi listing.

How it happened

  1. The constructor grants every privilege to the deployer: _setupRole(DEFAULT_ADMIN_ROLE, _msgSender());, _setupRole(MINTER_ROLE, _msgSender()); and _setupRole(PAUSER_ROLE, _msgSender());.
  2. Supply is created only through function mint(address to, uint256 amount) public virtual { require(hasRole(MINTER_ROLE, _msgSender()), ...); _mint(to, amount); }. There is no cap, no timelock and no limit per call, and the MGoldToken constructor body is empty, so no tokens exist until a minter calls it.
  3. A minter can mint to its own wallet and swap those tokens for BNB in the PancakeSwap pool. Each sale takes real BNB from the pool in exchange for tokens that cost nothing, and the price falls as the supply grows. Liquidity providers can also be withdrawn by whoever holds the LP tokens, which the token contract does not control.
  4. pause() requires only PAUSER_ROLE and _beforeTokenTransfer reverts with ERC20Pausable: token transfer while paused, so the pauser can stop all transfers, sells included. DEFAULT_ADMIN_ROLE can also grant these roles to other accounts.
  5. What happened, per PeckShield Alert and the De.Fi listing: on 2022-01-26 the deployer was reported to have drained more than 760,000 USD from MGOLD, with a liquidity removal, repeated mints and repeated sales listed as the evidence. The current total supply read from the chain is about 3.02 billion MGOLD, but that read is not a record of who minted; the code does not show it.

Protocol details

Classification Gaming / Metaverse
Protocol Type Exit Scam/Rugpull
Affected asset / contract MGOLD
Protocol links Website @MercenaryByIllu

Evidence

Same attack technique

Browse all hacks →
DollarDoge $194K lost Raptor2 $84K lost BNB HEROES $561K lost Sloth Inu $8K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes