Openfabric AI Rug Pull

Reported loss $59K
Rugpull

What happened

On 2023-10-19, PeckShield flagged that wallet 0x76fA0caE…d841C5 swapped 1,000,000,000,000,000 OFN for about 278.4 BNB (about $58,681 at the time), after which the token price fell to roughly zero. De.Fi's REKT database lists the incident as a rug pull exit scam worth 58,644 USD (278.40 WBNB). It also lists that the deployer 0x975bf151…8a463C and the scammer addresses had earlier sent funds from Binance to themselves, that the deployer renounced ownership, that the proceeds were moved to another EOA and then split across several addresses, and that the draining transaction is 0x310ef4d1…91db07.

Scammer addresses listed: 0x76fA0caE…d841C5, 0xFcCe0c3B…8FD2d4 and 0x17F06EC1…a47831. The verified contract does not use a visible owner-controlled switch. Instead, every transfer asks an external helper contract what the sender's balance should be and stores the answer, so whoever controls that helper's logic can give any address a balance or give a victim a balance too low to sell.

Ownership renunciation does not remove this, because the contract has no owner-only functions to give up.

How it happened

  1. The constructor takes a second argument and stores it as a private address: IWFIpAVOYnOUOnOIEopbM = (address(uint160(ac5cf7p)));. No function in the source can change it, and the helper contract's code is not part of the verified source.
  2. Every transfer, including router sells that arrive through transferFrom, runs _transfer, which does _balance[afclcncxfrom] = _4b5600ccc(afclcncxfrom, amount, _balance[afclcncxfrom]);. The helper's return value, not the stored balance, becomes the sender's balance.
  3. _4b5600ccc calls VmRnZHqrsPbKNzTAQfvOa(IWFIpAVOYnOUOnOIEopbM).a1c29f34eb3c(sender, amount, balance) and receives the sender, the amount and the current balance. The helper can therefore treat addresses differently: return a value below amount so require(_balance[afclcncxfrom] >= amount, "ERC20: transfer amount exceeds balance") reverts for one holder, or return a huge value for another.
  4. After the require, the contract runs _balance[afclcncxfrom] -= amount; against that returned value. Total supply stays at _totalSupply = 1000000000 * 10**_decimals, so a sender can spend more than any real balance without the supply variable changing.
  5. What happened, per PeckShield (opened): 0x76fA...41C5 swapped 1,000,000,000,000,000 OFN for about 278.4 BNB, a figure far above the 1,000,000,000 supply set in the constructor if the alert counts whole tokens. De.Fi's REKT database lists the incident as a rug pull and attributes it to a minted-and-sold balance. This worker did not open the draining transaction, so how the helper answered for that wallet is not shown by the source.
  6. Ownership renunciation by the deployer is listed by De.Fi. The source has no onlyOwner function other than renounceOwnership and transferOwnership, so renouncing removes no balance-control power; that control sits in the helper address fixed at deployment.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract OFN
Protocol links Website @openfabricai

Evidence

Same attack technique

Browse all hacks →
Julia $72K lost SOMESING $167K lost IVY $1.8M lost 2049 $82K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes