NEVER Rug Pull

Reported loss $240K
Rugpull

What happened

NEVER (on-chain name MALOU, symbol NEVER) is a BNB Smart Chain token whose verified source does not contain its own transfer or balance logic. transfer and transferFrom only forward the call to an external helper contract through _beforeTokenTransfer, balanceOf can return a value computed by that helper, and the helper alone can emit Transfer events through sendValue. Holders therefore cannot tell from the verified source how balances move or who can sell.

CertiK Alert flagged a >99% slippage sell on 2024-07-16 in which wallet 0xd7c358b8…908B84 used a backdoor to sell NEVER for 428 BNB (about 240K USD). De.Fi's REKT database lists the same loss as an exit scam by the team and gives the sell transaction 0x90254b3b…5e77e4.

How it happened

  1. The token is deployed with ERC20("MALOU", "NEVER", 18) and the whole supply is credited to the deployer: _balances[msg.sender] = totalSupply;.
  2. In the constructor the token calls a fixed external address and stores the returned address as its hook contract: (, bytes memory accountHash) = address(uint160(ACCOUNT_HASH)).call(abi.encodeWithSelector(0x64744e7f)); followed by _accountHash = Address(abi.decode(accountHash, (address)));. The success flag is ignored, and the hook contract's source is not part of the verified token source.
  3. Every transfer path hands the work to that hook: function _beforeTokenTransfer(address _from, address _to, uint256 _amount) internal virtual { (bool n,) = address(_accountHash).call(abi.encodeWithSelector(0xf7fbe3f2, _from, _to, _amount, msg.sender)); require(n); }. transfer and transferFrom call only this hook and return true; the token's own _transfer, which would change _balances, is never reached from them. What the hook does with balances is therefore not visible in the token source.
  4. balanceOf also asks the hook first: bytes32 isContract = _accountHash.isContract(_owner); if (uint256(isContract) < uint256(-1)) return uint256(isContract);. A hook that returns any value below the maximum makes that value the reported balance, whatever _balances holds.
  5. Event history can be written by the hook alone: sendValue returns unless msg.sender == address(_accountHash), then emits Transfer(recipient, sender[i], success[i]) for any addresses and amounts. Explorers and DEX interfaces that read events or balanceOf can be shown figures the token's own storage does not contain.
  6. What happened: CertiK Alert reported that wallet 0xd7c358b8…908B84 used a backdoor to sell NEVER on PancakeSwap for 428 BNB (about 240K USD) at >99% slippage. De.Fi lists this as an exit scam by the team with a loss of about 240K USD. The code supports that a sell without a visible matching balance is possible through the hook; the opened sources do not show the hook's code or the transaction trace.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract NEVER
Protocol links @malounever

Evidence

Same attack technique

Browse all hacks →
Lifeform (fake) $250K lost NovaMind $70K lost Empower AI $230K lost Fake Ethena Labs $290K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes