Patex Rug Pull

Reported loss $122K
Rugpull

What happened

This PATEX token on BNB Chain borrowed the name of the Patex project; CertiK called it a fake Patex token and said its deployer had created 11 tokens imitating other projects. It was deployed on 14 July 2023 by 0x2c6275ae…d5852f, which is still its owner. Its transfer and transferFrom return true without moving tokens whenever a transfer is refused. Sales into the pair or router pass only while two owner-set limits, _theNumber and _theRemainder, allow them, so the owner can stop every sale with one call, while buys and whitelisted wallets are never checked. The owner can also mint unlimited tokens to itself through rewardHolders, which emits no Transfer event, and the master address holds an unlimited allowance over the pair's PATEX.

On 18 July 2023 CertiK reported a large liquidity removal. De.Fi's REKT database puts it at 499 WBNB, about 121,664.74 USD, removed from the PancakeSwap V2 pool in transaction 0x42a22f6b…14bfb2 and split across four wallets.

How it happened

  1. The constructor mints the 9,999,999.000 PATEX supply (3 decimals) to the owner, makes the owner master, whitelists it, and sets _allowances[address(_pair)][master] = ~uint256(0).
  2. transfer and transferFrom only call _transfer when _canTransfer returns true. Otherwise they still return true, so a refused transfer moves nothing and does not revert.
  3. _canTransfer lets whitelisted wallets and transfers from the router or pair (buys) through. A transfer to the router or pair (a sale) passes only if bought >= sold + amount && _theNumber >= soldETH + amountETH && sender.balance >= _theRemainder; other wallet-to-wallet transfers return false.
  4. The owner can call setNumber(0) to block any sale worth more than zero BNB, or setRemainder to require more BNB in the seller's wallet than any holder has. The deployer is still owner.
  5. rewardHolders(amount) adds amount to the owner's balance and to _totalSupply with no event, a hidden mint the owner could sell into the pool. master can also pull PATEX out of the pair with its allowance and call syncPair().
  6. CertiK reported a large liquidity removal on 18 July 2023. No source opened here shows setNumber, setRemainder or rewardHolders being called.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract PATEX

Evidence

Same attack technique

Browse all hacks →
Scooby Pepe $238K lost Toothless - How to train meme $186K lost ROBIN HOOD $313K lost MOJO $28K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes