Meta Pets Rug Pull

Reported loss $709K
Rugpull

What happened

Meta Pets ($MP) is an Ethereum ERC-20 token whose source gives the deployer the entire fixed supply and a set of owner-only switches: uncapped fee setters, a wallet blacklist, transaction and cooldown limits, and functions that pull ETH and tokens out of the contract. Three payout wallets are hard-coded in the contract and are exempt from fees, the per-wallet cap and the cooldown. Etherscan transactions show the deployer added 15 ETH and 100 billion $MP of liquidity on 2021-11-18 at 18:01 UTC, and that the hard-coded marketing wallet (0x80F37688…F5cA0c) and development wallet (0x57C7CB16…A0f3C3) each sold about 19.89 billion $MP into the pool later that day, for about 38.86 ETH and about 6.27 ETH. De.Fi's REKT database lists the token as an exit scam/rugpull with 708,623 USD lost; the listing's wallet trail is kept below, and this research did not open every transaction in it.

De.Fi listing trail (as listed, not independently reopened except where noted above):

How it happened

  1. The constructor assigns the whole supply to the deployer: _tTotal = 1000000 * 10**6 * 10**_decimals; and _tOwned[_msgSender()] = _tTotal;. The contract has no mint function, so insiders' tokens come from this one allocation.
  2. Three payout wallets are hard-coded and exempted from the rules that bind other holders: address payable public developmentAddress = payable(0x57C7CB16A480232CC479D85A3c962e826FA0f3C3); and address payable public marketingAddress = payable(0x80F37688dD7850ac3B5884066C03897d9fF5cA0c);, with isExcludedFromFee[marketingAddress] = true;, isExcludedFromAntiWhale[marketingAddress] = true; and isExcludedFromTransactionCoolDown[marketingAddress] = true; (and the same lines for the development wallet).
  3. Ordinary holders pay a tax on every transfer: _totalFee =liquidityFee.add(marketingFee).add(developmentFee).add(maintainanceFee); is 120 of 1000 (12%), and if(recipient == uniSwapPair && sellExtraFee > 0) increaseFee(); adds 2% on sells. The seller is debited the full amount (_tOwned[sender] = _tOwned[sender].sub(amount);) while the recipient receives tTransferAmount, so the fee is taken from the seller's tokens.
  4. The owner can change the tax without any cap: function setSellExtraFeePercent(uint256 Fee) external onlyOwner { sellExtraFee = Fee; } and the four set...FeePercent setters likewise accept any value. Once the combined rate reaches 1000 a seller receives nothing, and above 1000 tAmount.sub(tFee) underflows and the transfer reverts. Fee-exempt wallets skip this through removeAllFee().
  5. The owner can block a specific holder or the pool: require(!isBlacklisted[from], "You are Blacklisted"); checks the token sender, so a blacklisted holder cannot send or sell, and a blacklisted uniSwapPair would stop buys. blacklistMultipleWallets accepts up to 799 addresses per call.
  6. The owner can also freeze trading for everyone else through the limits. With antiBotEnabled on, require(amount <= maxTxnAmount, "Transfer amount exceeds the maxTxAmount."); applies to every transfer not touching the owner, and setMaxTxnTokens or setTransactionCooldownTime accept any value, so a limit of 0 or a very long cooldown makes non-excluded transfers revert.
  7. Value can be withdrawn by the owner: function recoverETH() external onlyOwner sends the contract's ETH balance to the caller, recoverTokens transfers any token held by the contract, and swapAndLiquify mints LP tokens to owner() through addLiquidity(owner(), liquidityTokens, transferredBalance);. renounceOwnership() exists, but the on-chain owner read on 2026-09-30 is still the deployer 0x504aad03…4ddbb7.
  8. What the opened transactions show: the deployer added 15 ETH and 100 billion $MP of liquidity at 2021-11-18 18:01 UTC (tx 0xf6b2f700…f93b46). At 23:24 UTC the marketing wallet swapped about 19.89 billion $MP for about 38.86 ETH (tx 0x7dad2876…245db4), and at 23:38 UTC the development wallet swapped about 19.89 billion $MP for about 6.27 ETH (tx 0x71973719…5f2b96). Each sale is far above the constructor default maxTxnAmount of 1 billion tokens, so by the code the limit must have been raised or antiBotEnabled switched off before those sales; no transaction showing that was opened.

Protocol details

Classification Gaming / Metaverse
Protocol Type Exit Scam/Rugpull
Affected asset / contract MP
Protocol links Website @MetaApesGame

Evidence

Same attack technique

Browse all hacks →
BNB HEROES $561K lost Sloth Inu $8K lost Daughter Doge Revenge Token Loss not disclosed Evolved Apes $2.3M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes