Pepe Coin Rug Pull

Reported loss $95K
Rugpull

What happened

This "Pepe" (PEPE) token on BNB Chain imitated the Pepe memecoin. Its verified contract does not contain its own transfer logic: transfer and transferFrom hand execution to a separate contract through delegatecall, and a whitelisted address can swap that contract at any time, so the code that decides whether a holder can sell is not part of the verified source and can be changed after people buy. The owner can also mint any amount of new tokens and keeps a blacklist that the delegated code can enforce.

CertiK reported a large liquidity removal on this imitation Pepe Coin, said the deployer removed about 65,000 USD from the liquidity pool, and noted that the deployer had created several imitation tokens before. De.Fi's REKT database dates the removal to 19 April 2023, puts the loss at about 95,000 USD, and says the deployer also sold tokens, dropping the price about 90%.

How it happened

  1. The constructor gives the deployer the 1 billion token supply and whitelists it: _balances[_msgSender()] = _totalSupply; and _whitelist[_msgSender()] = true;.
  2. setProxyAddr(address _addr) only checks _whitelist[msg.sender] == true and then sets proxyAddr. The owner can add more whitelisted addresses with addWhitelist.
  3. transfer and transferFrom run proxyAddr.delegatecall(...). Delegated code runs with the token's own storage, so it can read and write every balance, the blacklist and the allowances. Whether a holder's sale succeeds depends entirely on that unverified contract, which can be replaced between a buy and a sell. The local _transfer function is never called by either.
  4. mint(address account, uint256 amount) is onlyOwner with no cap, and addBlacklist lets the owner mark any address. The contract has transferOwnership but no renounce function. The token's totalSupply() today reads about 1.27 trillion PEPE, over 1,000 times the 1 billion created at deployment.
  5. CertiK reported that the deployer removed about 65,000 USD of liquidity from the pool; De.Fi's REKT database lists three removal transactions on 19 April 2023 with a total loss of about 95,000 USD.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract PEPE

Evidence

Same attack technique

Browse all hacks →
Void.Cash $34K lost fcdep $675K lost ANT Token $36K lost Move token $87K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes