What happened
Stonks Token ($STONKS) is a BNB Smart Chain reflection token that De.Fi's REKT database lists as an exit scam/rug pull on 2021-09-03. Its verified source gives the owner uncapped control over the three transfer fees and the maximum transaction size, which is enough to redirect most of every holder transfer to an owner-chosen wallet or to make all ordinary transfers revert. It also carries a lock/unlock ownership routine that can make the contract look ownerless while the previous owner keeps the right to take ownership back.
The code shows what the owner could do; no opened source confirms which of these powers were used.
How it happened
- The owner can call
setTaxFeePercent,setLiquidityFeePercentandsetCharityFeePercentwith any value; none of them checks an upper bound. - Fees are subtracted in
_getTValueswithtAmount.sub(tFee).sub(tLiquidity).sub(tCharity). The sender is always debited the full amount, so a charity fee near 100 sends almost the whole transfer to_charityWallet, which the owner sets withsetCharityWallet. If the three fees add up to more than 100, the SafeMath subtraction reverts and every fee-paying transfer, including sells to the PancakeSwap pair, fails. - Separately,
setMaxTxAmounthas no floor._transferenforcesrequire(amount <= _maxTxAmount, ...)for any transfer that does not involveowner(), so a value of 0 blocks all holder buys and sells while the owner can still move tokens. lock(time)stores the owner in_previousOwnerand sets_ownerto zero, soowner()reads as the zero address.unlock()lets_previousOwnerrestore ownership after the lock time, andrenounceOwnership()does not clear_previousOwner, so an apparent renounce can be reversed.- De.Fi's REKT database lists
$STONKSas an exit scam/rug pull dated 2021-09-03. The loss amount and the exact on-chain actions are not recorded in any source opened for this draft.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
