SCAT Rug Pull

Reported loss $26K
Rugpull

What happened

SPACE CAT (SCAT) is a BEP-20 reflection token deployed on BNB Chain on 26 September 2022 at 0x22a681b2…ca859A, trading against USDT on PancakeSwap. Its owner can block any address from sending tokens with setBlackHolder, freeze balances with setLockedBalance, set the per-transaction limit to zero, and raise the tax or liquidity fee with no upper bound through setTaxFeePercent and setLiquidityFeePercent, which skip the 25% cap enforced by setFee. On 10 November 2022 CertiK reported an exit scam on this contract, with the price down about 95.61% and about $133K taken.

De.Fi's REKT database puts the loss at 26,081 USD and says an EOA received 100,000,000,000 SCAT, the whole supply, from the deployer, drained the PancakeSwap pool and moved the funds through TransitSwap; it lists 0xc96d3505…43e8f6 and 0xb0f6da67…70b4a4 as the addresses involved.

How it happened

  1. The constructor credits the whole 100,000,000,000 SCAT supply to the deployer, sets it as _owner, excludes it from fees and creates a SCAT/USDT pair on PancakeSwap.
  2. setBlackHolder(address holder, bool banned) is onlyOwner, and _transfer runs require(!blackHolder[from], "Black list address"), so a listed holder cannot sell or move tokens.
  3. setLockedBalance lets the owner assign a locked amount to any address, and setLockedParams can move _lockedEndTime into the future. While that time has not passed, _lockedBalanceCheck returns false for every listed address and the transfer reverts with "locked".
  4. setMaxTxPercent stores its argument times 10^18 as _maxTxAmount with no lower bound. Every transfer not involving the owner must satisfy amount <= _maxTxAmount and amount > 0, so a value of zero stops all such transfers.
  5. setFee checks that the five fees total at most 25%, but setTaxFeePercent and setLiquidityFeePercent set _taxFee and _liquidityFee directly with no check. Only senders on _isExcludedFromFee skip fees, so the owner can make holders' sales lose any share of their tokens, or revert entirely once the fees exceed 100% and tAmount.sub(tFee).sub(allFee) underflows.
  6. resetPool lets the owner withdraw any BNB or tokens held by the token contract. CertiK and De.Fi report that value was taken from the pool; the opened sources do not say which of these functions, if any, was used.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract SCAT

Evidence

Same attack technique

Browse all hacks →
Cezar Hard Fork $399K lost Artificial intelligence robot $152K lost DeFi Safe $127K lost King Tribe $997K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes