Theory Craft Fames Rug Pull

Reported loss $69K
Rugpull

What happened

Theory Craft Fames (TYF, BNB Smart Chain contract 0x5459b93a…fdF326) restricts who can move tokens. Transfers between ordinary wallets revert, and sells from a wallet only pass if _usdtPair equals the pool the sale goes to; both setUsdtPair and a per-address allowance table are controlled by the admin. The admin can also set an uncapped percentage that is moved to the dead address from the recipient of every transfer.

On 2023-04-11 CertiK Alert reported that the deployer removed liquidity in 3 transactions, profiting about 69,000 USD, and described the token as appearing to be a honeypot. De.Fi's REKT database lists the price as dropping about 90% after the liquidity was removed and the tokens sold.

Scammer address as listed by De.Fi: 0x8dce7d8d…9773ca Liquidity removal transaction: 0x6bb3c129…8de6c3

How it happened

  1. The constructor mints the whole supply to the deployer and gives them the admin role: _mint(creater_,totalSupply_*10**decimals()); and _grantRole(DEFAULT_ADMIN_ROLE, _msgSender());.
  2. Every transfer and transferFrom runs the TYF._transfer filter. Unless the recipient is the dead address, it only lets a transfer through if one of three branches matches: the sender has quota left in _botHMDArr, the sender is a contract (isTxt(from)), or from==_usdtPair||to==_usdtPair. Anything else reverts with Block is busy, please try again.
  3. Buys pass because the pool is a contract, so isTxt(from) is true. A sell from a wallet passes only if to==_usdtPair. _usdtPair starts empty and is set by setUsdtPair, which the admin controls, so if it does not point at the real pool, wallet sells and wallet-to-wallet transfers revert while buys still work. setBotHMDArr lets the admin give chosen addresses a quota that skips the filter.
  4. setBackscale stores an uncapped _scale. In _tokenTransfer the sender is debited the full amount, the recipient is credited it, and then super._transfer(recipient, _destroyAddress, tAmount.div(100).mul(_scale)) moves that percentage from the recipient to the dead address. At a high _scale a buyer keeps little, and a pool that receives a sell loses most of the credited tokens, so the seller gets paid for only the remainder. A _scale above 100 makes the 100-_scale step fail for every transfer except those to the dead address.
  5. What happened, per CertiK Alert: the deployer removed the pool's liquidity in 3 transactions for about 69,000 USD and the token appears to be a honeypot. Which of the admin settings above was active is not shown by the sources opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract TYF

Evidence

Same attack technique

Browse all hacks →
ChainGPT $82K lost Iwr token $34K lost XCAD $100K lost Zodiac Credit $77K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes