Script Token Rug Pull

Reported loss $134K
Rugpull

What happened

Script (SCPT) was a BNB Chain token paired with USDT on PancakeSwap, deployed on 31 March 2023 by 0x77978388…9d5db9. Its code blocks every sale and wallet-to-wallet transfer until a private switch, canSell, is turned on, and that switch starts off. Only a hidden _tokenOwner address, set at deployment, can flip canSell or give any holder a sell limit through maxSellToken; buys from the pair are never checked. These powers sit outside the normal owner() role, so moving ownership to the dead address does not remove them.

On 2 April 2023 CertiK reported that the deployer had removed liquidity in five transactions over 48 hours, a loss of about $133K, and said the token appeared to be a honeypot. De.Fi's REKT database puts the loss at 133,857 USD, names 0x77978388…9d5db9 as the address behind it, and gives 0x948975f3…903015 as an example liquidity removal transaction.

How it happened

  1. The constructor mints all 100,000,000 SCPT to a tokenOwner constructor argument, stores it in the private _tokenOwner, and creates a pair against USDT.
  2. In _transfer, a transfer from the pair (a buy) only pays a 5% burn. A transfer to the pair (a sale) runs require(canSell,"canSell"), and so does any other transfer between non-exempt wallets.
  3. canSell is declared as bool canSell; with no initial value, so it starts false. Only _tokenOwner can call changeCanSell() to flip it, and maxSellToken(userAddress, tokens) lets _tokenOwner cap how much any single address can ever sell.
  4. Before any fee exemption is checked, a transfer that adds liquidity to the pair must come from _tokenOwner: if(isAddLdx){ require(_tokenOwner == from); }. Addresses set with excludeFromFees (the token owner, the deployer and the contract at deployment) then skip the canSell and sell-limit checks. Only addresses in _isExcludedFromVipFees (the contract itself and pairs added with addOtherTokenPair) skip every check.
  5. _tokenOwner is not tied to owner(), so moving ownership to the dead address leaves these controls in place.
  6. According to CertiK, the deployer removed the pool's liquidity in five transactions over 48 hours, about $133K. No source opened here shows whether canSell was ever switched on for holders.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract SCPT

Evidence

Same attack technique

Browse all hacks →
TRT $93K lost OBB $96K lost Arbitrum token $70K lost BWR $47K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes