NWN Rug Pull

Reported loss $110K
Rugpull

What happened

NWN is a BEP-20 token on PancakeSwap with a fixed supply of 1,000,000 NWN, all minted to an owner address passed to the constructor and exempt from fees. CertiK's Skynet alert of 27 September 2022 reported a possible exit scam on the token: a price drop of more than 89%, one third of the minted tokens moved to address 0xbb30f, and about 110K USD gained by the scammer. The earlier record states that address 0xbb30f770…d27281 received tokens from three other addresses (transactions 0xe2afc14d…da6c8b, 0xef7cdf81…c1015a and 0xd6efd870…c8864a), sold 410,000 NWN on PancakeSwap and drained the pool's liquidity, sent more than half of the proceeds to another EOA and kept 50,000 BUSD at the original address (De.Fi listing).

The sale of a large, pre-distributed balance into the pool needs no special function. The verified code also gives the owner a blacklist and uncapped tax setters, but the owner address now reads as the zero address, and no source shows that any of those controls were used in this incident.

How it happened

  1. The constructor sends the whole supply to the owner address given at deployment and exempts it from tax: _balances[owner] = _totalSupply; and isExcludedFromFee[owner] = true;.
  2. What the code ALLOWS while an owner exists: multipleBotlistAddress(address[] calldata accounts, bool excluded) public onlyOwner fills _isBlacklisted, and _transfer requires !_isBlacklisted[sender] && !_isBlacklisted[recipient]. Blacklisting a holder blocks that holder's sells and receives; blacklisting the pair address would block every buy and sell. setSelTaxes(...) external onlyOwner() has no ceiling, and takeFee moves feeAmount from the seller to the contract, so a 100% sell tax leaves the seller with nothing; above 100% amount.sub(feeAmount...) reverts every sell.
  3. The owner can also give the controls up: function waiveOwnership() public virtual onlyOwner { ... _owner = address(0); }. The owner reads as the zero address in a 2026-09-30 call, so the setters are unreachable now; when ownership was waived is not shown.
  4. What was reported: tokens were gathered in one address, 410,000 NWN were sold on PancakeSwap, the pool lost most of its liquidity and the price fell by more than 89% (CertiK alert and the De.Fi listing). No transaction shown here ties the drop to a blacklist or tax change.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract NWN

Evidence

Same attack technique

Browse all hacks →
The Micro Elements $573K lost Lets Go Farming Token $37K lost e-STD $49K lost TIGER $784K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes