MetaFinanceDAO Rug Pull

Reported loss $380K
Rugpull

What happened

MetaFinanceDAO (FD) is a copycat BEP-20 token on BNB Chain paired with BSC-USD. Its constructor mints the whole fixed supply to the deployer, and the owner controls an uncapped sell fee, a buy-restriction switch and a whitelist, so the code gives the deployer both the inventory and the levers to exit at the expense of holders. CertiK Alert reported on 2022-10-12 an exit scam on the copycat project FD with slippage above 88% and about 373k taken, citing this contract.

De.Fi's REKT database lists the deployer as having sent FD tokens to an EOA address that drained about 380,000 USD of liquidity (380,300 USD in the headline figure) and then moved the stolen funds to another EOA. Addresses and transactions from the De.Fi listing: scammer address 0xd7dc8314…69d09b, relation proof transactions 0xbfb7968b…eaf051 and 0x79a102f7…aba897, and the BSC-USD movements of 0xd7dc8314…69d09b as the liquidity drain evidence. The owner functions described below show what the code allows, not which calls were made.

At the 2026-09-30 read, owner() returned the zero address, so these functions can no longer be called.

How it happened

  1. The constructor mints the entire supply to the deployer and whitelists both the deployer and the FD/BSC-USD pair: _mint(_msgSender(), 1000000000000000 * 10**18);, timelist[_pair] = true;, timelist[_msgSender()] = true;. No other mint exists, so supply is fixed, but the initial inventory sits in one wallet.
  2. Buys from the pair are blocked for non-whitelisted buyers until createTime: if(from == _pair){ ... if(timestamp > createTime) return; require(timelist[to] == true,"address is not allowed"); }. The owner can move that time with setCreateTime and edit the list with setWhitelist, so it can re-close buying for everyone except chosen addresses. Sales to the pair are not covered by this check.
  3. Sells pay sellFee percent, and the owner sets it with no upper bound: function setSellFee(uint256 _sellFee) public onlyOwner () { require(_sellFee > 0,"_sellFee must egt zero"); sellFee = _sellFee; }. In _transfer the seller is debited the full amount first, then _balances[seller] += _feeNum; credits the fee wallet and SafeMath.trySub(amount,_feeNum) returns 0 once the fee reaches the amount, so at 100% or more the pair receives nothing for the sale.
  4. The fee wallets buyer and seller are owner-set (setBuyer, setSeller); until set, fees are credited to the zero address.
  5. Nothing in the code stops the deployer from transferring its balance to another address and selling into the FD/BSC-USD pool. CertiK's alert reports an exit scam on this contract with about 373k taken. De.Fi's REKT database adds that an EOA funded with FD by the deployer drained the pool's BSC-USD (about 380k per De.Fi) and passed the proceeds on to another EOA.
  6. renounceOwnership is inherited from Ownable (transferOwnership rejects the zero address); the zero-address owner read at 2026-09-30 means renounceOwnership was called at some point, but no transaction was opened to say when.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract FD

Evidence

Same attack technique

Browse all hacks →
DDCX $148K lost SHOK $71K lost KHABY Fan Token $33K lost LGT $35K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes