SharkTron Rug Pull

Reported loss $10.0M

Oct 28, 2020

Rugpull

What happened

Quick Summary

Malicious function in the staking contract allowed the contract deployer to transfer 229M TRX from it. The tokens were then spread to different EOAs and exchanges.

Details of the Exploit

The contract deployer had the ability to call the rrInfo() function in the staking contract, which was designed for the malicious transfer of TRX from it. An example of this function calling resulted in a 1M TRX transfer. The code of the smart contract isn’t verified.

The deployer then bought SRX and SWD on JustSwap. There was another malicious function, getAllT(), which was used to perform a rug pull, removing 229M TRX from the staking contract. These TRXs were then sent to other EOAs.

Block Data Reference

The contract deployer:

Address TJTAYh…Btdz

Example of the function calling (1M TRX transfer):

Source

Transaction of 229M TRX removed from staking contract:

Source

Transactions of TRXs sent to other EOAs:

Source