RepubliK Rug Pull

Reported loss $121K
Rugpull

What happened

RepubliK (RPK) was a BNB Chain token deployed on 23 November 2023 by 0x4ba48590…3AA571, and its verified contract holds no balances. balanceOf, transfer and transferFrom all forward to a separate accounting contract that only the owner could set and whose code is not part of the verified source, so the published token code says nothing about who can hold, move or sell RPK. The constructor emits a Transfer event for 1,000,000 RPK without recording any balance, and every transfer emits its event before the hidden contract decides what happens. Renouncing ownership only stops the owner from pointing the token at a new accounting contract.

Within hours of deployment, PeckShield reported that the deployer address swapped 100,100,100,100,100,100,100.1001 RPK, vastly more than the stated supply, for 998.37 WBNB (about $236K), and the price fell to zero. De.Fi's REKT database describes the event as a liquidity removal of 235,995 USD and puts the funds taken at 121,445 USD (513.77 WBNB), sent to another address and then split across several more. It lists the liquidity-adding transaction 0x414f0b26…d45c5a and the liquidity removal transaction 0xeb9ff840…253df7.

How it happened

  1. The token stores no balances. balanceOf(who) returns Accounting(accounting).balanceOf(who), and transfer and transferFrom return Accounting(accounting).doTransfer(...).
  2. setAccountingAddress lets the owner set accounting to any contract; the address is private and its code is not in the verified source.
  3. The constructor sets _totalSupply = 1000000 * 10 ** 9 and emits Transfer(address(0), msg.sender, _totalSupply), but totalSupply is only a stored number. The accounting contract can report any balance for any address, including one far above that supply, and can refuse any holder's transfer.
  4. transfer and transferFrom emit Transfer before the call, so explorers show movements whether or not the hidden contract carried them out.
  5. PeckShield reported that the deployer 0x4ba4...A571 swapped 100,100,100,100,100,100,100.1001 RPK into the pool for 998.37 WBNB (about $236K), taking the price to zero. A balance that size exceeds the 1,000,000 supply the token reports, which is consistent with balances being set by the accounting contract rather than the token.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract RPK
Protocol links @Republican__US

Evidence

Same attack technique

Browse all hacks →
AISurf $112K lost PAPABEAR $121K lost Creso $154K lost Web $179K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes