PePe Coin Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

PePe Coin ($PePe) is a BEP-20 token on BNB Chain built from a generic pausable, blacklistable template (the verified contract is named ChinaCreatedCovid). The owner can create unlimited tokens with mint, freeze every transfer and approval with pause, and block chosen addresses with blackListAddress. The blacklist checks only the caller (msg.sender) of transfer or transferFrom, not the token holder, so its effect depends on which address is listed: blacklisting the DEX router would block sells and liquidity adds made through it, while blacklisting the pair would block buys and the token side of liquidity withdrawals.

The contract has no renounce function and transferOwnership rejects the zero address, so these powers stay with an owner. De.Fi's REKT database lists the token as an exit scam/rug pull; the record's earlier text described the project as abandoned with low activity and no significant user losses, and no transaction evidence of either was found.

How it happened

  1. The constructor sets totalSupply = _supply * 10**_decimals, credits all of it to the tokenOwner passed at deployment and makes that address the owner. The supply read on-chain on 2026-09-30 is 1,000,000,000,000 $PePe; the constructor amount itself was not read, and mint and burn can change the total after deployment.
  2. mint(address account, uint256 amount) is onlyOwner and has no cap, so the owner can mint any amount to any address and sell it into the pool.
  3. pause() is onlyOwner; while paused, transfer, transferFrom, approve and the approval helpers all revert through whenNotPaused, which stops every holder from selling or moving tokens.
  4. blackListAddress(address, bool) is onlyOwner. transfer and transferFrom both check tokenBlacklist[msg.sender], the caller, not the _from holder in transferFrom. A blacklisted holder cannot call transfer directly, but can still approve the router and sell through it, because the router is msg.sender in transferFrom. Blacklisting the router instead blocks sells and liquidity adds that go through its transferFrom, but not buys; blacklisting the pair blocks buys (the pair calls transfer to pay the buyer) and the token leg of liquidity withdrawals, but not sells.
  5. There is no renounceOwnership, and transferOwnership requires a non-zero new owner, so the contract cannot be left ownerless by setting the owner to address(0); the owner read on-chain on 2026-09-30 is 0x5f0e0f73…6e5e05.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract PePe
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
ChocSwap.finance Loss not disclosed PenginFinance Token Loss not disclosed White Moon Finance Loss not disclosed Red Eagle Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes