ROT Token Rug Pull

Reported loss $116K
Rugpull

What happened

ROT (ROT) is a BEP-20 token on BNB Smart Chain at 0xc631a358…c04BE9, deployed on 6 February 2023 by 0xb909a7E2…5430D1. Its constructor saves the deployer in a private variable, contractSender1, that no function can change. Only that address can call setYuerTfcAddSeeoCos, which gives any holder a hidden number.

With a large enough number, every sell or wallet transfer from that holder has its amount set to zero and reverts, while buys from the pool still work. The public owner role is separate. It now points to the dead address, but contractSender1 keeps its power regardless.

On 9 February 2023 CertiK reported that the deployer appeared to have blacklisted holders so they could not sell ROT, and that about $116,000 had been removed from the liquidity pool over the previous three days. De.Fi's REKT database lists the loss as $116,150 across two liquidity removals, 0xd78db6f4…ee07c6 and 0xb32c4606…52f091.

How it happened

  1. The constructor credits the whole 100,000,000 ROT supply to a tokenOwner argument and makes it the owner. It also stores the deploying address in contractSender1 = msg.sender;, which has no setter.
  2. setYuerTfcAddSeeoCos(address account,uint256 maxtSeeoCos) is not onlyOwner. It checks require(msg.sender == contractSender1); and writes _yuerTfcAddSeeoCos[account], so only the deployer can call it, and changing or renouncing the owner does not remove this power.
  3. In _transfer, every transfer that is not a buy from the pool runs uint256 seeocos = 1 * 100000000 * _yuerTfcAddSeeoCos[from];. When seeocos >= amount.add(amount.add(_yuerTfcAddSeeoCos[from])), it sets amount = amount*0;, and the later require(amount > 0, ...) reverts. A large value for an address blocks every sell and transfer it makes, and the error looks like an ordinary zero-amount failure.
  4. Transfers out of the pool skip this check, so buyers can still buy. For the first 30 seconds after the pool is detected, buys deliver only 1% of the amount (amount = amount.div(100);).
  5. CertiK reported on 9 February 2023 that holders appeared to be blacklisted from selling and that about $116,000 had been removed from the ROT liquidity pool over three days. De.Fi lists two removal transactions totalling $116,150.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract ROT

Evidence

Same attack technique

Browse all hacks →
SUI Token $100K lost Zodiac Credit $33K lost DOXED $30K lost China Rabbit $88K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes