NFDAO Rug Pull

Reported loss $88K
Rugpull

What happened

NFDAO (NFD) is a BNB Chain token at 0xe1afc0a3…edfda3 with 300,000 NFD minted to the deployer and a PancakeSwap pool against USDT. Its code blocks all pool trades except liquidity adds until the owner calls startTrade, takes 99% of every buy in the first 100 blocks after that and sends it to the marketing wallet, and charges an 8% fee on later trades, part of it paid through an invite contract the owner could replace. Liquidity removals are exempt from fees.

On 5 June 2023 De.Fi reported that a deployer-related wallet removed all liquidity from the NFD/USDT pool, about $88,000, and the token price fell 90%. According to De.Fi's REKT database, the removal (tx 0xb6d28af3…857d5f) was made by 0x91b6854e…62c6cb, linked to deployer 0xA90ab5bE…9b6970, and the funds were moved to 0x7E0E658a…922eEc (tx 0x45317e4c…84471a).

How it happened

  1. The constructor mints the full 300,000 NFD to the deployer, creates the NFD/USDT pair, and excludes the owner, the marketing wallet and the contract from fees.
  2. Before launch, a trade with the pool by a non-excluded wallet hits require(startBlock > 0 && isAdd, "!Trade"), so only liquidity adds go through. The owner opens trading with startTrade().
  3. For 100 blocks after startTrade, if (isMarketPair[sender] && startTradeBlock + 100 >= block.number) { feeAmount = _amount.mul(99).div(100); _balances[marketingAddress] = ... gives the buyer 1% of the tokens they bought and the marketing wallet the rest.
  4. After that, pool trades pay 1% burn, 1% to the marketing wallet, 2% to nodeAddress and 4% to referrers, whose amounts and addresses come from Invite(invite). The owner could repoint invite with setInviteAddress and switch fees with setFeeEnable; ownership now reads as the zero address, so these settings are fixed as last set.
  5. isRemoveLP makes a liquidity withdrawal fee-free, and nothing in the token restricts who can withdraw liquidity.
  6. On 5 June 2023 a deployer-related wallet removed all liquidity from the NFD/USDT pool, about $88,000, and the price fell 90%, according to De.Fi.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract NFD

Evidence

Same attack technique

Browse all hacks →
SpaceX Copycat $22K lost USEA Token $1.1M lost POOPEPE token $100K lost Fintoch $31.7M lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes