SpaceX Copycat Rug Pull

Reported loss $22K
Rugpull

What happened

SpaceX is an unrelated ERC-20 token that reuses a well-known company name and symbol. The contract gives the whole 50,000,000 supply to the deployer at creation, and the deployer stayed the contract owner. The owner also has two powers that regular ERC-20s lack: redeemCoupon credits any address with a huge balance without raising totalSupply, and setExactTransferAmount can limit an address to a single allowed transfer size. De.Fi's REKT database lists the token as an exit scam: the deployer sold its SpaceX holdings into the Uniswap liquidity pool for 13.16 ETH across two transactions and bridged the proceeds to BSC through the Multichain bridge, and De.Fi lists the loss as 21,516 USD. That USD figure is De.Fi's listed value and was not reproduced from an opened source: the first sale transaction alone, 0x39c83e47…2c2680, shows the deployer address swapping 20 million SpaceX for about 10.47 ETH through the 1inch router on 2023-06-13 at 06:07 UTC, and the USD value of that sale at the time may be higher than the listed figure.

Deployer address: 0xeC2D2aE3…2D0aA5

Liquidity draining transactions (as listed by De.Fi): 0x39c83e47…2c2680 and 0xdea2ea6a…753fe5

Bridging transaction (as listed by De.Fi): 0x1d46c086…881014

How it happened

  1. The constructor sets _balances[_msgSender()] = _totalSupply;, so the deployer receives the entire 50,000,000 token supply and is also the Ownable owner.
  2. According to De.Fi's posted thread, the token launched on 2023-06-11. The opened sources do not show who added the SpaceX/WETH liquidity or who paid ETH into the pool.
  3. The contract keeps owner-only controls over holders' ability to transfer. setExactTransferAmount(address account, uint256 amount) external onlyOwner stores a per-address amount, and both transfer and transferFrom then run require(amount == exactAmount, "TT: transfer amount does not equal the exact transfer amount"); whenever it is non-zero. A holder set to an amount other than what they try to sell cannot sell; transfers from the pair are limited the same way if the pair address is set.
  4. redeemCoupon(string memory couponCode, address recipient) external onlyOwner runs _balances[recipient] += couponValue; for coupons preloaded in the constructor (for example _couponLedger["COUPON2023"] = _totalSupply*10000000;). It never changes _totalSupply, so the owner can credit any address with a balance far larger than the stated supply. The opened transaction does not show whether this was used.
  5. On 2023-06-13 the deployer address sold 20 million SpaceX into the Uniswap pool for about 10.47 ETH in transaction 0x39c83e47…2c2680. De.Fi's REKT database lists a second sale, 0xdea2ea6a…753fe5, bringing the total to 13.16 ETH, and a loss of 21,516 USD; the opened first sale alone is about 10.47 ETH, so these listed figures were not reconciled.
  6. De.Fi reports the ETH was bridged to BSC through Multichain in 0x1d46c086…881014, and says the sell-off left the pool inadequate for trading.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract SpaceX

Evidence

Same attack technique

Browse all hacks →
GUIDO The Mechanics $63K lost Midgets Token $41K lost USEA Token $1.1M lost NFDAO $88K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes