Strong Finance Rug Pull

Reported loss $61K
Rugpull

What happened

Strong Finance (STRONG) is an ERC20 token on Ethereum with a Uniswap V2 pool against WETH, deployed on 5 Dec 2023. On 6 Dec 2023 PeckShield reported that the address 0x9E83c241…b42962 swapped 1,000,000,000,000,000 STRONG for 26.75 WETH (about 61.1K USD), against a total supply of 100,000,000 STRONG. Etherscan shows the swap in transaction 0x8f06eb0b…5af2cb, sent by 0x82a4f9c0…CAFfeF to 0x9E83c241…b42962 through a swap(uint256 _tokenId) call, with about 26.75 WETH leaving the pool. De.Fi's REKT database lists the loss as 61,081 USD (26.74 WETH), the deployer as 0xb112034a…eE4178, and the scammer address as 0x82a4f9c0…CAFfeF. It also says the proceeds moved to another EOA and then through a chain of addresses to Binance, in transactions 0x8f387cda…cb1e2e and 0x95fec935…fa7156.

0x9E83c241…b42962 is the _taxWallet the contract was deployed with, and the code explains how it could sell far more tokens than exist: for fee-exempt senders the transfer logic debits nothing from the sender while crediting the recipient in full.

How it happened

  1. The constructor takes address stWallet, sets _taxWallet = stWallet; and marks it exempt with isFeeExempt[_taxWallet] = true;. Etherscan shows the constructor argument 0x9E83c241…b42962. The owner and the contract are also exempt.
  2. Once enableStrongTrade() has set feeEnabled = true, _transferToken computes the amount debited from the sender as uint256 amountOut = takeFee ? tAmount : feeEnabled ? takeFeeAmounts(actions, takeFee, tAmount) : tAmount;. For an exempt sender takeFee is false (takefee = isTakeFees(sender) is !isFeeExempt[sender]).
  3. In takeFeeAmounts with takefee == false, percents resolves to 1, then feeAmounts = takefee ? feeAmounts : amounts * percents; makes the fee equal to the whole amount, and return amounts.sub(feeAmounts); returns 0. So amountOut is 0 and the line _balances[sender] = _balances[sender].sub(amountOut, ...) subtracts nothing from the exempt sender.
  4. For the same transfer amountIn = feeEnabled && takeFee ? ... : tAmount; is the full tAmount, and _balances[recipient] = _balances[recipient].add(amountIn); credits the recipient in full. takeFeeAmounts also adds 1% of the amount to _balances[address(this)]. An exempt wallet can therefore send any amount to the pair, up to the allowance it gave the router, without holding the tokens, and the pair's token balance rises by that amount.
  5. A swap through swapExactTokensForETHSupportingFeeOnTransferTokens then pays out WETH from the pool against tokens that were never taken from anyone. Ordinary holders are not exempt: for them amountOut is the full tAmount and they are debited normally.
  6. What happened: PeckShield reported 0x9E83c241…b42962 swapping 1,000,000,000,000,000 STRONG for 26.75 WETH, and Etherscan shows the pool paying about 26.75 WETH in the transaction above at 2023-12-06 03:30:59 UTC.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract STRONG

Evidence

Same attack technique

Browse all hacks →
Do Right $371K lost EI Risitas $52K lost Abattoir of Zir $226K lost CKD TOKEN $485K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes