TRBAS3 Rug Pull

Reported loss $3K
Ethereum
Rugpull

What happened

TRBAS3 is an airdrop-style token whose owner address keeps unrestricted minting rights. The constructor credits a 768,800-token team fund to the deployer, and DistributeAirdrop(address _participant, uint _amount) is onlyOwner and credits any amount to any address; the only check is require( totalDistributed < totalSupply ), which is evaluated before the amount is added, and the owner can raise totalSupply with add(uint256 _value). The owner also has withdrawAll() for the contract's ETH and withdrawForeignTokens. Etherscan shows the deployer address calling DistributeAirdrop twice on 2020-12-14, minting 537,600 TRBAS3 in one call and about 7.69 million TRBAS3 to its own address in the other. De.Fi's REKT database lists the project as an exit scam/rug pull with a loss of 3,176 USD and says the deployer sold tokens in multiple transactions through the Uniswap router.

The contract deployer invoked the minting function and DistributeAirdrop() to generate new tokens onto his wallet: Tx 1 0xd1a7…51a7 Tx 2 0x9cd3…c1f2 Tx 3 0xd2ac…7e1c

De.Fi's listing says tokens were sold by the contract deployer in multiple transactions: Source

How it happened

  1. The constructor sets owner = msg.sender; and calls distr(owner, teamFund) with uint256 teamFund = 768800e18;, so the deployer starts with the whole declared supply (deployment transaction 0xd1a72cc4…5351a7).
  2. function DistributeAirdrop(address _participant, uint _amount) onlyOwner external { Distribute(_participant, _amount); } calls Distribute, which runs require( totalDistributed < totalSupply ); and then balances[_participant] = balances[_participant].add(_amount); totalDistributed = totalDistributed.add(_amount);. The check happens before the new amount is added and Distribute is not gated by canDistr, so a single call can credit an amount far above the remaining supply, and finishDistribution() does not stop it.
  3. The owner can also raise the ceiling with function add(uint256 _value) onlyOwner public { uint256 counter = totalSupply.add(_value); totalSupply = counter; }. The on-chain totalSupply value read on 2026-09-30 is 110,707,200 tokens against the 768,800 declared at deployment; in this source only add raises that variable, but the value alone does not show how many tokens were minted.
  4. On 2020-12-14, per Etherscan, the deployer address 0xBE923088…461734 called DistributeAirdrop in transactions 0x9cd32b80…3dc1f2 (537,600 TRBAS3) and 0xd2acd26e…057e1c (about 7.69 million TRBAS3, to 0xBE923088…461734).
  5. De.Fi's REKT database lists the deployer as selling tokens in multiple transactions with the Uniswap router; those sale transactions were not opened.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract TRBAS3
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
Ethereum UnlimitedBase Finance $6K lost Ethereum Reflation $9K lost Ethereum DEFIBase $379K lost Ethereum Farmland Network $892 lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes