SHADE INU Token Rug Pull

Reported loss $54K
Rugpull

What happened

SHADE INU Token (SadeIT) is a BNB Chain token at 0x24676Ea2…C43d7e, deployed on 6 July 2022 by 0x698C726d…8BA003. Its transfer function contains a hidden mint: when the caller is flagged in the private _release mapping, which the constructor sets for the deployer and nothing can clear, the function only adds amount to the recipient's balance, without debiting the caller, emitting a Transfer event or changing totalSupply. The contract also fakes a renounced owner, because onwner() always returns the zero address while the real owner stays in a private variable, and that owner can set sell fees and per-wallet fees with no upper limit.

De.Fi's REKT database lists SadeIT as a rug pull. According to the listing, the creator minted 5 billion tokens in the deployment transaction 0x5f5bd205…c146d7, and a PancakeSwap pool was created (0xcba09086…eaef9e) with 200 BNB that 0x91a20dcb…b4b073 sent to the creator (0x09aa93f9…62137f). Two swaps of about 983 trillion SadeIT (0xd2811df9…edc733 and 0xd6fb62ac…32ddc7) returned 424.8 BNB, a profit of 224.8 BNB. De.Fi adds that all the tokens were then moved to another address in transaction 0x1b672d0a…a939fa, and that from that address 150 BNB went to 0x5f56e93b…706f6c, the creator of the $NodyC token, which it says was also rugged.

How it happened

  1. The constructor mints totalSupply_ * 10**18 to the deployer, sends 40% of it to the dead address, and then sets _release[_msgSender()] = true for the deployer. No function can change _release afterwards.
  2. In transfer, a _release caller skips the normal path: _balances[to] += amount; return true;. The caller's balance is never debited, no Transfer event is emitted and totalSupply does not move, so the deployer can credit any address with any amount of SadeIT while explorers still show the original supply.
  3. onwner() is hard-coded to return address(0), so the token appears renounced, but onlyonwner checks the private _onwner, which is still the deployer unless renounceonwnership was called. Renouncing would not remove the _release power in step 2.
  4. The owner can call upS to set the default sell fee and setSfiyy to set a per-wallet fee that overrides it, both without an upper limit. The fee is debited from the sender and sent to the dead address; a fee above 100 makes _amount - tradefiyyamount underflow, so that wallet's transfers and sales revert.
  5. De.Fi reports that about 983 trillion SadeIT were sold into the pool in two swaps for 424.8 BNB. If that figure is accurate, it exceeds the 5 billion total supply, and the _release branch of transfer is the only code path that can create such a balance.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract SadeIT
Protocol links Website @ShadeToken

Evidence

Same attack technique

Browse all hacks →
Forest Tiger Pro $733K lost RETAWATCH $29K lost BabyDAO $8K lost Dark Light $134K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes