Rubick Finance Rug Pull

What happened

RUBIK.FINANCE (RBK) is an Ethereum token deployed on 16 November 2020 at 0x960a223f…bdb1eb by 0x9bd1597b…72adf3, which is still its owner. Its owner can mint any amount of RBK to any address with no cap, and can freeze any holder so that the holder's transfers and sales revert. On 17 November 2020 the deployer added 30 ETH of liquidity to the Uniswap V2 RBK pool.

On 20 November 2020 it minted 1,000,000 RBK to its own wallet and two minutes later sold them into the pool for about 40.58 ETH (0x620e0b9b…b8869d), roughly 10.58 ETH more than it had put in. The sale drained the pool's ETH, so remaining holders could no longer sell RBK for anything of value.

How it happened

1. The constructor mints the initial supply to the deployer, who becomes owner through Ownable.
2. mint(address account, uint256 amount) is onlyOwner and calls _mint with no cap, so the owner can create new RBK at will; each mint also raises totalSupply.
3. freeze(address[] memory account) is onlyOwner and sets frozen[account] = true; _transfer starts with require(!frozen[sender], "frozen"), so a frozen holder cannot transfer or sell. unfreeze clears one address.
4. On 17 November 2020 the deployer added 30 ETH of liquidity to the Uniswap V2 pool.
5. On 20 November 2020 at 04:42 UTC the deployer called mint for 1,000,000 RBK to its own address (0x8741a293…2d9096).
6. At 04:44 UTC it swapped the 1,000,000 RBK for 40.578 ETH through the Uniswap router, draining the pool's ETH and leaving other holders unable to sell for value.

Protocol details

Classification Yield Aggregator

Protocol Type Exit Scam/Rugpull

Affected asset / contract RBK

Protocol links Website

Evidence

• report @CaptainJackAPE incident report twitter.com
• transaction RBK contract creation transaction etherscan.io
• transaction Etherscan: transactions of deployer 0x9bd1597b...adf3 etherscan.io
• transaction Etherscan: RBK mint transaction 0x8741a293...96 etherscan.io
• transaction Etherscan: RBK to ETH swap 0x620e0b9b...9d etherscan.io
• address RUBIK.FINANCE (RBK) verified contract code on Etherscan etherscan.io
• analysis Web Archive web.archive.org
• analysis Sourcify exact match for 0x960a223f27b474de35f05b27210cc62cf7bdb1eb on Ethereum repo.sourcify.dev