The Micro Elements Rug Pull

Reported loss $573K
BNB Chain
Rugpull

What happened

The Micro Elements (TME) is a BNB Chain token at 0xd631464f…37f71e, deployed on 20 July 2022 by 0x4FF04c51…09e1A9, that trades against USDT on a PancakeSwap pair its constructor creates. The constructor mints nothing: every TME in existence came from mint, which any address the owner approves with setMinner can call with no cap, and the total supply read on-chain in September 2026 is about 100 quintillion TME. The owner also holds two trading switches, canTransfer and canSwap; while both are off, only addresses on the owner's whitelist can move tokens at all.

The fee setters carry a 20% check, but it does not bound the real fee total: currentAllFee leaves out deadFeePercent (it starts at 7% while the six rates add to 10%), and setDeadFeePercent checks against devFeePercent instead of the old dead fee, so repeated calls let the owner push real fees past 20%. On 11 October 2022 CertiK flagged an exit scam with a price drop above 95% and about $548.6K taken; the existing record says an EOA funded by the deployer, 0x2b5f629b…92e8dd, drained the pair and still held the proceeds.

How it happened

  1. The constructor sets the fee rates, creates the TME/USDT pair with liquidity = _factory.createPair(_usdtToken, address(this)) and makes the deployer owner, but mints no tokens.
  2. The owner can grant mint rights with setMinner(address, true). A minter can then call mint(address to, uint256 value), which calls _mint with no supply cap. The supply read on-chain (100000000002021000000000000000000000000 raw units at 18 decimals) was all created this way.
  3. The owner controls setCanTransfer and setCanSwap. transfer and transferFrom revert with "can not transfer" unless one switch is on or an address involved is whitelisted; with only canSwap on, non-whitelisted transfers must go to or from the pair.
  4. Addresses the owner adds with addWhitelist skip both checks and every fee, so they can move and sell tokens whatever the switch state.
  5. renounceOwnership later left the owner at the zero address, which freezes the switches and whitelist, but it does not clear the minner mapping, so any minter approved earlier keeps its mint right.
  6. What happened: CertiK reported a drop of more than 95% and about $548.6K taken on 11 October 2022. The existing record attributes the pair drain to 0x2b5f629b…92e8dd, funded by the deployer in transaction 0x06ef4302…51eded.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract TME

Evidence

Same attack technique

Browse all hacks →
LGT $35K lost FlokiChain $111K lost Lets Go Farming Token $37K lost NWN $110K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes