NONAME Rug Pull

Reported loss $30K
Ethereum
Rugpull

What happened

NONAME (NONAME, Ethereum, contract 0x09ff2267…6c76bb) is an OpenZeppelin-style token whose deployer holds the minter role, an uncapped mint, and a whitelist-admin role that can set the transfer tax with no upper limit. The code also lets that role repoint the pair that receives the LP reward. De.Fi's REKT database lists the project as an exit scam/rug pull with $30,120 lost, and says the project also ran a crowdsale through a NonameCrowdsale contract. Etherscan shows the deployer 0x961E3149…3DCbfd adding 400 NONAME and 5.9 ETH of liquidity on 2020-12-02, then removing all of it and selling about 3,100 NONAME on 2021-02-15. A Safe smart account that De.Fi calls the proxy contract forwarded 26 ETH to each of two external wallets on 2020-12-03.

Transactions and addresses listed by De.Fi:

How it happened

  1. At deployment the contract inherits MinterRole and WhitelistAdminRole, whose constructors run _addMinter(_msgSender()); and _addWhitelistAdmin(_msgSender());, so the deployer holds both roles.
  2. What the code allows: function mint(address account, uint256 amount) public onlyMinter returns (bool) { _mint(account, amount); has no cap, and _mint raises _totalSupply. A minter can also add more minters with addMinter. renounceMinter exists, so the power can be given up; no opened transaction shows it being renounced.
  3. What the code allows: setTransactionTax(uint256 _taxDivisor) has no bound. In _transfer, taxAmount = amount.div(taxDivisor) is split into _rewardLiquidityProviders(from, taxAmount.div(2)) and super._burn(from, taxAmount.div(2)), and the recipient gets amount.sub(taxAmount). The sender is debited the full amount in total, so a divisor of 1 makes the recipient's share zero. setUniswapV2Pair lets the same role point the reward transfer at a different address.
  4. What happened, per Etherscan: a Safe smart account sent 400 NONAME to the deployer on 2020-12-02 at 16:54 UTC, and 13 minutes later the deployer added 400 NONAME and 5.9 ETH of liquidity, receiving 48.5798 LP tokens. De.Fi describes the 400 tokens as minted through the proxy contract; the page shows a transfer from the Safe.
  5. On 2020-12-03 the same Safe sent 26 ETH to each of two external wallets (De.Fi links the crowdsale as the source of that ETH; the crowdsale transactions were not opened).
  6. On 2021-02-15 at 19:27 UTC the deployer called removeLiquidityETHWithPermitSupportingFeeOnTransferTokens, burning 48.58 LP tokens, and at 19:31 UTC swapped about 3,100 NONAME for 0.17 ETH through the router.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract NONAME

Evidence

Same attack technique

Browse all hacks →
Ethereum Focus $10K lost BNB Chain Wallstreetswap Finance $2.9M lost BNB Chain Astronaut NFT $187K lost Ethereum Tranquility Defi $13K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes