What happened
Raptor2 is a BNB Chain token deployed on 16 February 2022 at 0xC51B24E6…7755Ba. Its transfer function gives a whitelist, which starts with the owner and the token contract, a full bypass of every trading rule, while everyone else can only trade with the PancakeSwap pair, only while the owner keeps _isTradingOpen on, and can sell only if their address and the calling contract are not on a blacklist. Any whitelisted address can add wallets to that blacklist or the whitelist, and the owner can close trading for non-whitelisted holders at any time, so the deployer's side can sell while holders can be stopped.
According to De.Fi's REKT database, the deployer added the initial liquidity in transaction 0x78e7b5eb…2af9d4, later removed the liquidity and sold tokens in 0xfbceeb8c…c585f7, and sent the proceeds to 0xdaa5e569…f4d34a in 0xef06c291…86bd5d. PeckShield reported on 21 February 2022 that 0xdaa5e569…f4d34a dumped Raptor2 and deposited 855 BNB into Tornado Cash.
How it happened
- The constructor creates the PancakeSwap pair, gives the whole supply of 1,000,000,000,000 tokens (9 decimals) to the deployer, and whitelists the owner and the token contract.
- In
_internalTransfer, any transfer where neither side is whitelisted must passrequire(_isTradingOpen), and because_isSwapEnabledis set to true with no setter, it must also have the pair as sender or recipient, which blocks plain wallet-to-wallet transfers. - When a non-whitelisted holder sells (recipient is the pair), the transfer reverts if the holder or
_msgSender()(the router on a router sale) is in_isAddressBlacklisted. modifyBlacklistandmodifyWhitelistareonlyWhitelist, notonlyOwner, so any whitelisted wallet can blacklist sellers or whitelist new wallets, andrenounceOwnershipwould not remove those powers.openTrading(bool value)isonlyOwnerand can switch trading off again, freezing every non-whitelisted holder while whitelisted wallets keep trading.- De.Fi's listing says the deployer then removed the liquidity and sold, and PeckShield traced 855 BNB from 0xdaa5e569…f4d34a into Tornado Cash.
Protocol details
Evidence
- report PeckShieldAlert: $Raptor2 rugged, 855 BNB deposited to Tornado Cash (21 February 2022) twitter.com
- transaction Raptor2 contract creation transaction bscscan.com
- transaction De.Fi REKT database entry for Raptor2 (write-up with transaction list) de.fi
- transaction bscscan.com transaction 0x78e7…f9d4 bscscan.com
- transaction bscscan.com transaction 0xef06…bd5d bscscan.com
- transaction bscscan.com transaction 0xfbce…85f7 bscscan.com
- address Raptor2 verified contract code on BscScan bscscan.com
- address bscscan.com address 0xdaa5…d34a bscscan.com
- analysis Sourcify match for 0xC51B24E6809B4E4578BE862c4Be19d8d767755Ba on BNB Chain repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
