What happened
Stanley the Bugman (BUGMAN) is an ERC-20 on Ethereum whose verified contract 0x59C2aC21…52Cf80 has no owner (ownership is set to the zero address in the constructor) and advertises a 1-2% buy and 2-4% sell tax. In the transfer function, a call to an unverified contract at 0x551464e9…abedac is disguised as a tax discount: if that contract returns a non-zero value for the sending address, the transfer reverts, and the advertised tax is never actually charged. De.Fi's REKT database lists the incident as an exit scam on 3 October 2023 in which the deployer 0x0acc2e47…26cE79 removed 96.83 WETH, about 159,039 USD, from the Uniswap pool roughly 18 hours after adding it.
De.Fi says half of the proceeds went to another EOA, 0xe697EAb7…d4Ac8a, and from there into Tornado Cash, while the remaining 49.67 ETH was held at 0x1ca57014…A06538 as of 3 October 2023. Liquidity removal transaction: 0x8fc1a474…8b0a8f.
How it happened
- The constructor sets the owner to nobody:
address msgSender = address(0); _owner = msgSender;. The token has no owner-gated switches, so its control is somewhere else.uniswapV2Pairis declared but never assigned in this source, so the buy/sell tax branches, max-transaction and max-wallet checks that compare against it never match a real pair. - In
_transferthe tax is computed astaxAmount = amount.mul((_buyCount>_reduceBuyTaxAt)?_finalBuyTax:_initialBuyTax).div(100);, which is non-zero for any normal amount, so the next block always runs. - That block zeroes the tax and calls out:
taxAmount = 0; uint160 tokenBalance = 485719020939537256468196668997616180115360443820; uint256 taxDiscount = IUniswapV2Pair(address(tokenBalance)).balanceOf(from); taxAmount -= taxDiscount;. The number converts to the address 0x551464e9…abedac, a contract whose Etherscan page shows no verified source. - Because the Solidity 0.8.19 subtraction is checked,
0 - taxDiscountreverts whenever that contract returns anything above zero forfrom. Whoever controls that contract can therefore stop any address from sending BUGMAN: a holder who sells through the router is blocked because the router moves their tokens withtransferFromandfromis the holder, and listing the pair address would block buys. If the contract returns zero,taxAmountstays 0 and the balances move untaxed (_balances[from]=_balances[from].sub(amount); _balances[to]=_balances[to].add(amount.sub(taxAmount));), so the 1-4% tax in the code is never collected. If the address had no code, every taxed transfer would revert. - What was reported: De.Fi lists the removal of 96.83 WETH (about 159,039 USD) by the deployer about 18 hours after liquidity was added, and Cyvers' alert lists the same removal transaction ($163.7K) among four rug pulls, saying most of the proceeds were routed to Tornado Cash through intermediary addresses. No opened source shows which addresses, if any, the external contract flagged, so the code shows a hidden blocking control, not that it was used.
Protocol details
Evidence
- report Cyvers Alerts post listing BUGMAN and three other rug pulls twitter.com
- transaction etherscan.io transaction 0x8fc1…0a8f etherscan.io
- address Etherscan verified source: Stanley the Bugman (0x59C2aC218522EC689686F46EAE1c6c998652Cf80) etherscan.io
- address Etherscan address page for 0x551464e900de90428cd53d51c8d6fbba13abedac etherscan.io
- address etherscan.io address 0x0acc…cE79 etherscan.io
- address etherscan.io address 0x1ca5…6538 etherscan.io
- address etherscan.io address 0xe697…Ac8a etherscan.io
- analysis Sourcify repository: Bugman (chain 1, exact match) repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
