Raichu Thunderstone Rug Pull

Reported loss $15K
Rugpull

What happened

Raichu Thunderstone (RAI) is an Ethereum token deployed on 30 September 2023 at 0x3564A13c…b83DC3 by 0xF4FA6Fc6…FFB30F. Its owner is set to the zero address in the constructor, so the token looks renounced from the start, but every taxed transfer calls balanceOf(from) on a hard-coded external contract, 0x551464E9…AbedAC, and subtracts the answer from zero. Any non-zero answer makes the subtraction underflow and the transfer revert, so whoever controls that unverified contract can decide which addresses can sell or move RAI.

The advertised 2% and 4% taxes are never charged, because the tax is reset to zero before this check. Later that day the deployer removed its Uniswap V3 position in transaction 0xde82a653…8e42d5, taking about 4.87 billion RAI and 37.23 WETH; De.Fi's listing gives about 37.05 WETH (60,264 USD) and says the funds went to another EOA and then to multiple addresses, including 0x6C42b841…6Feeb9 and 0x214fBe9d…D58575.

How it happened

  1. The Ownable constructor sets _owner = address(0), so owner() returns the zero address and renounceOwnership can never be called; the token appears ownerless.
  2. Because no real transfer involves the zero address, the condition if (from != owner() && to != owner()) is true for every transfer, and taxAmount becomes 2% (or 4%) of the amount.
  3. The tax branch then runs taxAmount = 0;, loads the hard-coded address 0x551464E9…AbedAC (stored as the decimal uint160 constant 485719020939537256468196668997616180115360443820) and calls IUniswapV2Pair(...).balanceOf(from) on it.
  4. It executes taxAmount -= taxDiscount;. Under Solidity 0.8.19 checked arithmetic, any non-zero taxDiscount underflows and reverts the whole transfer. That contract therefore acts as a hidden blocklist for any sender, including a holder selling into the pool; the balanceOf call is declared non-view, so it can also change state.
  5. The helper contract's source is not verified, so holders cannot read the rule that decides who is blocked.
  6. On 30 September 2023 the deployer removed its Uniswap V3 liquidity position and received about 4.87 billion RAI and 37.23 WETH.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract RAI

Evidence

Same attack technique

Browse all hacks →
Ninja Gaiden $89K lost EigenLayer $821K lost DUO $334K lost BNBpay $54K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes