PIPI Rug Pull

Reported loss $121K
Rugpull

What happened

PIPI is a BEP-20 token on BNB Chain (0x158f194C…6D0b84), deployed on 14 November 2023 from a generic CoinToken template. The owner can mint any amount with an uncapped mint, blacklist or greylist any address, and switch on a flag ab that automatically greylists every wallet that buys from the pool, after which those wallets can no longer send or sell their tokens. On 15 November 2023 PeckShield reported that PIPI dropped 99.92% after the deployer address 0xCC78A249…C2f66C swapped 807,333,011,534.96 PIPI for 121,348 BSC-USD.

De.Fi's REKT database records the loss as 121,373 USD, names 0x6896bd31…4447f9 as the scammer address, and lists 0x2e8d0600…f38fad as the liquidity removal transaction.

How it happened

  1. initToken assigns the whole initial supply to tokenOwner, makes it owner, and creates the pair as LP. The Ownable contract has no transferOwnership or renounceOwnership, so the owner role cannot be handed off or given up.
  2. The owner can call changeAb(true). From then on, whenever the pair sends tokens to a buyer (msg.sender==LP&&ab&&!tokenWhitelist[_to]), the buyer is written into tokenGreylist.
  3. transfer and transferFrom require tokenGreylist[msg.sender] == false or tokenGreylist[_from] == false unless the sender or recipient is whitelisted, so a greylisted buyer cannot sell back to the pool or move the tokens. blackListAddress, geryListAddress and their batch versions let the owner block any address directly.
  4. The owner can also call mint(address account, uint256 amount) with no cap, adding tokens to any balance without touching the pool.
  5. PeckShield reported that the deployer swapped 807,333,011,534.96 PIPI into the pool for 121,348 BSC-USD, and the price fell 99.92%.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract PIPI

Evidence

Same attack technique

Browse all hacks →
Dor $103K lost CredixFinance $26K lost Builders NFT $89K lost BABYFIDO $79K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes