Project culs Rug Pull

Reported loss $278K
Rugpull

What happened

culs is a BEP20 token on BNB Smart Chain (contract 0xc31AbB4B…08cef9) with a PancakeSwap culs/USDT pair. The verified source gives the deployer-owner an unrestricted per-address blocklist (setStop) that makes any transfer to or from a listed address revert, and takes a fixed 8% fee on sells, part of which goes to two hard-coded wallets. On March 21, 2023, CertiK's Skynet alert reported 99% slippage on the token and said the deployer appeared to have removed $278,442 from the liquidity pool.

De.Fi's REKT database lists the incident as an exit scam / rug pull of $278,442 and records the deployer as 0xa2621b2a…90ce88, with three liquidity-removal transactions: 0xa73fbe3c…633498, 0x2e030c45…c34fe3 and 0x5e880375…51472a. The same listing says the token price fell by about 90%. The contract source contains no function that withdraws liquidity; removing liquidity is done through the router by whoever holds the LP tokens, and no opened source shows who held them.

How it happened

  1. The deployer creates the token: the constructor mints the whole 21,000,000 supply to msg.sender, sets _owner = msg.sender, and creates the culs/USDT pair on the PancakeSwap router.
  2. The owner can blocklist addresses at will: function setStop(address _addr, bool _bool) external onlyOwner{ isStop[_addr] = _bool; }, enforced in every transfer by require((!isStop[from] && !isStop[to]),"address error");. A holder listed as from cannot sell, because a router sell calls transferFrom(holder, pair, amount). If the pair address were listed, every buy and sell would revert.
  3. Sells carry a fixed fee: in the recipient==uniswapV2Pair branch the rates are 10 + 10 + 20 + 15 + 25 per mille, i.e. 8%. The _inviterFee share is paid to the hard-coded fundAddress2 and the _fundFee share to fundAddress through _takeTransfer; the sender's full amount is debited by _rOwned[sender] = _rOwned[sender].sub(rAmount). The fee values are fixed in code, not owner-adjustable.
  4. Liquidity is not locked by the contract. swapAndLiquify sends LP tokens to the hard-coded lpAddress, and nothing in the source restricts how LP tokens held by any address are redeemed through the router's removeLiquidity.
  5. What was reported: on March 21, 2023, CertiK Skynet reported 99% slippage on culs and said the deployer appeared to have removed $278,442 from the pool; De.Fi lists three liquidity-removal transactions from the deployer. The source alone does not show who held the LP tokens or which transactions removed liquidity.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract culs
Protocol links Website @ProjectPlutus_

Evidence

Same attack technique

Browse all hacks →
DESTINY Protocol $121K lost EC token $44K lost APPLE $30K lost SpaceID $33K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes