Midgets Token Rug Pull

What happened

Midgets (MIDGETS) was an ERC-721A NFT collection on Ethereum that sold mints for ETH, with the owner setting the price through setCost. Mint payments stay in the contract, and an owner-only withdraw() sends the contract's whole ETH balance to the owner in one call, with no vesting, cap or second signer. About 13 hours after deployment, the deployer called withdraw() and received 24.605 ETH (tx 0x09992564…683cbb).

Cyvers flagged this as a rug pull and reported the funds were sent on to Binance. De.Fi's REKT database says they passed through another EOA first (txs 0x276d1df9…438739 and 0x44c5389f…95f91f) and values the loss at 40,842 USD.

How it happened

1. Buyers mint through mint or whitelistMint. Both are payable and check require(msg.value >= cost * _mintAmount, 'Insufficient payment!'); (one mint is free while isFreeMintEnabled is on). The owner sets the price with setCost(uint256 _cost), which has no upper bound.
2. The contract never forwards mint payments, so the ETH builds up in the contract's balance.
3. withdraw() is onlyOwner and runs (bool os, ) = payable(owner()).call{value: address(this).balance}('');, moving the entire balance to the owner in one transaction.
4. The owner also controls the collection's state: setPaused stops minting and burning, setRevealed and setUriPrefix decide what metadata holders see, and mintForAddress mints NFTs to any address without payment, up to maxSupply.
5. On 2023-06-14 at 22:14 UTC the deployer (still the owner) called withdraw() and received 24.605 ETH from the contract. Cyvers reports the ETH went on to Binance.

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract MIDGETS

Evidence

• report @CyversAlerts incident report twitter.com
• report Cyvers Alerts on X: rug pull on MIDGETS token twitter.com
• transaction Etherscan transaction 0x09992564... (withdraw, 2023-06-14) etherscan.io
• transaction Etherscan deployment transaction for Midgets etherscan.io
• transaction etherscan.io transaction 0x276d…8739 etherscan.io
• transaction etherscan.io transaction 0x44c5…f91f etherscan.io
• address Etherscan verified contract code, Midgets (MIDGETS) 0x917216459430b99034767416c21f54f82abb5db6 etherscan.io
• address etherscan.io address 0x8295…A54b etherscan.io
• analysis Sourcify repository, contracts/Midgets.sol for chain 1 address 0x917216459430b99034767416c21f54f82abb5db6 repo.sourcify.dev