PAULY Rug Pull

Reported loss $224K
Rugpull

What happened

PAULY was an Ethereum meme token whose creator 0x4340dECa…D3a2C9 removed about 116.1 ETH from its Uniswap V2 pool on July 14, 2023, roughly $224,000 according to De.Fi, and then moved the funds to another wallet. The verified code shows the token was built to be controlled rather than traded fairly: a hard-coded _Owner can mint without limit through setRule, a second hard-coded address can wipe any holder's balance with a function misleadingly named Approve, and renounceOwnership() and lock() are empty functions that do nothing. The contract also rewrites its own Transfer events so the creator's movements appear under a different address.

How it happened

  1. address public _Owner = 0x4340dECaf719350a71592Cb76a825Bce31D3a2C9; is fixed in the code, with no setter.
  2. setRule(locker, amt) requires msg.sender == _Owner, then adds amt to _totalSupply and to _balances[_Owner], while emitting Transfer(address(0), locker, amt). It is an unlimited mint whose event names a different recipient than the one credited; the constructor uses it so the initial supply appears to go to the team address 0x8DFD4f30…523938.
  3. _transfer swaps the addresses in the log: if (sender == _Owner){sender = team;}if (recipient == _Owner){recipient = team;}, so explorers show team instead of the creator.
  4. Approve(address[] recipients), callable only by 0xa36E4985…bAb75B, moves each listed holder's entire balance to address(0) without emitting an event. execute and dropToken only emit fake Transfer events.
  5. renounceOwnership() and lock() have empty bodies, so calling them removes none of these powers.
  6. On 2023-07-14 18:59 UTC the creator called removeLiquidityETHWithPermit on Uniswap V2 Router 2 and received about 116.16 ETH and 9.22 trillion PAULY (tx 0xacd94273…be5de1). De.Fi reported the ETH was then sent to an EOA.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract PAULY

Evidence

Same attack technique

Browse all hacks →
MOJO $28K lost GMETA $3.7M lost Agent Smith $227K lost BJS $290K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes