Ore Rug Pull

Reported loss $243K
Rugpull

What happened

This "Ore" (ORE) token on Ethereum shared its name with an unrelated legitimate project and presented itself as an ERC-404 token, but its working code is a plain ERC-20 with hidden owner functions under misleading names. The owner, 0xAD13D88d…C25b5C, can create ORE out of nothing inside the token contract and sell it into the Uniswap pool for almost all of its WETH, can block any holder from transferring, and can cut any holder's balance by an arbitrary factor. On 26 February 2024 the owner called the token contract, which sold 201.08 million ORE (the stated total supply is 25,000 ORE) into the pool for 80.03 WETH, about 243,500 USD, sent to 0x9594f577…A142dB.

PeckShield reported the token dropping 100% and labelled it a rug pull.

How it happened

  1. The constructor sets owner = msg.sender;, gives the owner the 25,000 ORE supply and creates the Uniswap V2 ORE/WETH pair. The contract has no function that transfers or renounces ownership.
  2. Address(address _r) is onlyOwner. It reads the pair's WETH reserve and targets 99.999% of it: uint256 calling = (Sub(_RR.WETH()) * 99999) / 100000;.
  3. The internal Allowance helper asks the router how much ORE that WETH would cost (getAmountsIn) and adds exactly that amount to the token contract's own balance with b[...] += value[0];, where the address is address(this) hidden behind _T(). _totalSupply is never increased, so the mint does not show in the supply.
  4. getContract then approves the router for the contract's balance and calls swapTokensForExactTokens, sending the pool's WETH to _r. No LP tokens are needed: the pool is emptied by a sale of newly created tokens.
  5. Two more owner-only functions work against holders. multicall sets c[holder] = b[holder] / _p + 10, and _transfer then requires add(c[from], b[from]) == 0, which can never hold, so the holder can no longer transfer or sell. multicall2 replaces a holder's balance with b[holder] / _p and emits a fake Transfer to the pair to disguise the cut as a sale.
  6. On 26 February 2024 at 09:54 UTC the owner sent a transaction to the token contract with a single address argument, 0x9594f577…A142dB, matching Address(address _r). The contract sold 201.08 million ORE into the pool and 80.03 WETH went to that address (0xb8f05ade…b184ec).

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ORE

Evidence

Same attack technique

Browse all hacks →
FA $255K lost Fake Polyhedra Network $400K lost Not Found $200K lost JohnLennonC0IN $11K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes