PAPABEAR Rug Pull

Reported loss $121K
Rugpull

What happened

PAPABEAR (PAPA) is a BEP20 token on BNB Chain whose verified contract 0x90F06678…2e76f8 stores no balances of its own. balanceOf and every transfer are delegated to a separate Accounting contract whose address the owner sets with setAccountingAddress, and that contract's code is not part of the verified source. De.Fi's REKT database lists the incident as a rug pull on 23 November 2023: the deployer 0x1B567913…A748c4 removed liquidity worth 235,249 USD from the PancakeSwap pool, for a listed loss of 120,648 USD (510.4 WBNB), which was moved to another EOA and then split across several addresses.

PeckShield's alert instead describes the deployer swapping an amount of PAPA far above the contract's 1,000,000-token supply for 995.21 WBNB (about $235K). Liquidity adding transaction: 0xd61ab6ca…930770; liquidity removal transaction: 0x741e51f9…1301d6.

How it happened

  1. The constructor sets the supply and stores no balances: _totalSupply = 1000000 * 10 ** 9; emit Transfer(address(0), msg.sender, _totalSupply);. Balances are read from a separate contract: return Accounting(accounting).balanceOf(who);.
  2. Every transfer is handed to that external contract, with the Transfer event emitted first: emit Transfer(msg.sender, to, amount); return Accounting(accounting).doTransfer(msg.sender, msg.sender, to, amount);. transferFrom does the same after reducing the allowance.
  3. Only the owner chooses that contract: function setAccountingAddress(address accountingAddress) public { require(msg.sender == owner); accounting = accountingAddress; }. Whoever controls the chosen contract controls what every holder and the pair sees as their balance and whether any transfer succeeds, and the verified source does not show that logic. renounceOwnership exists, and a latest-block read on 2026-09-30 returned the zero address as owner; when it was renounced, and what the accounting contract does, is not established here.
  4. What was reported: PeckShield's alert says the deployer address swapped 100,100,100,100,100,100,100.1001 PAPA for 995.21 WBNB (about $235K), a quantity far above the 1,000,000 PAPA the contract reports as total supply. De.Fi lists the loss as a liquidity removal with 510.4 WBNB (120,648 USD) sent to another EOA and then distributed. The two accounts of the mechanism differ, and no transaction was opened to settle it.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract PAPA

Evidence

Same attack technique

Browse all hacks →
Jewels $64K lost AISurf $112K lost RepubliK $121K lost Creso $154K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes