Rise Protocol Rug Pull

Reported loss $59K
Ethereum
Rugpull

What happened

Rise Protocol (RISE) is a rebasing reflection token on Ethereum that minted its entire 100,000-token supply to the deployer and traded on a Uniswap V2 RISE/WETH pool funded by the deployer. Etherscan shows the deployer adding liquidity on 2021-02-11 (10 ETH with 1,000 RISE, then 240 ETH with 24,000 RISE) and, on 2021-03-11, removing liquidity (262.1 ETH and 26,470.38 RISE) and selling 42,055.37 RISE for 14.65 ETH 32 seconds later. De.Fi's REKT database lists the project as an exit scam with a 59,164 USD loss and says the liquidity had been locked until February 12 before the deployer removed it.

The token contract also gives the owner switches over trading, fee splits and per-transaction limits.

How it happened

  1. The constructor assigns the whole supply to the deployer: _rOwned[_msgSender()] = reflectionFromToken(_totalSupply, false); with _totalSupply = 10**5 * 10**9. The deployer is also the Ownable owner and the rebaser, and owner() still reads as the deployer address.
  2. Etherscan shows the deployer adding liquidity to the Uniswap V2 RISE/WETH pool in two addLiquidityETH transactions on 2021-02-11 (0xab9d2e39…2d293a with 10 ETH and 1,000 RISE, and 0x2d49344f…82cd35 with 240 ETH and 24,000 RISE). The LP tokens went to the deployer; the token contract has no lock or LP-handling code.
  3. The owner holds switches that decide how everyone else can trade. _enableTrading() is onlyOwner, and until it is called _transfer reverts for calls from the pair or the router with Rise: trading is disabled.; if(sender != owner() && recipient != owner() && !inSwapAndLiquify) exempts the owner from require(amount <= _maxTxAmount, ...), and _setMaxTxAmount accepts any value down to 10^8 (0.1 RISE).
  4. The fee setters are capped (require(fee < 50, ...) for setSellFee and setTxFee) but the split is not. setBurnTop and setBurnBottom take any value, and _getTValues computes tBurnFee = BURN_TOP*fee/BURN_BOTTOM; tRewardFee = fee.sub(tBurnFee);. If the burn share exceeds the fee, sub reverts, so a fee-bearing sell or transfer would fail, and BURN_BOTTOM = 0 divides by zero. _setRewardAddress can point the reward share of every fee at any wallet.
  5. What happened, per Etherscan: on 2021-03-11 at 17:24:05 UTC the deployer called removeLiquidityETH on Uniswap V2 Router 2 and received 262.1 ETH and 26,470.38 RISE, then at 17:24:37 UTC swapped 42,055.37 RISE for 14.65 ETH through swapExactTokensForETHSupportingFeeOnTransferTokens (0x3697937b…d60602 and 0x7bb3e71f…27246f). The pool's ETH side was removed by its liquidity provider; none of the owner functions in step 3 or 4 is shown to have been used.

Protocol details

Classification Yield Aggregator
Protocol Type Exit Scam/Rugpull
Affected asset / contract RISE
Protocol links Website @RiseProtocol

Evidence

Same attack technique

Browse all hacks →
Ethereum Mantle $10K lost BNB Chain Horizon Finance $25K lost Ethereum Contribute Protocol $4K lost BNB Chain MoltenSwap $122K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes