What happened
This TrustPad was a copycat BEP20 token on BNB Chain that borrowed the name of the TrustPad launchpad. Its verified contract keeps no balances at all: balanceOf and every transfer are handed to a separate "accounting" contract whose address the owner set and whose code is not part of the verified source. That hidden contract decides what each address holds and whether any transfer succeeds, so it can let buyers in, refuse their sells and credit the deployer with any balance.
PeckShield reported that the deployer, 0x2Ca8Ec9d…A3b4fd, swapped about 100.1 quintillion TPAD, far more than the 1,000,000 TPAD reported as total supply, for 1,015.33 WBNB (about $240,000), and TPAD fell 100%. De.Fi's listing describes this as a liquidity removal worth $240,006, with the funds spread across several addresses, and puts the net loss at $56,329 (390.58 WBNB).
How it happened
- The token contract stores no balances:
function balanceOf(address who) view public returns (uint256) { return Accounting(accounting).balanceOf(who); }. - Every
transferandtransferFromemits aTransferevent and then returns whateverAccounting(accounting).doTransfer(msg.sender, from, to, amount)decides, passing the caller so the ledger can treat the router, the pair and each wallet differently. The constructor likewise emits a full-supplyTransferwithout recording any balance. - The owner points the token at the ledger with
setAccountingAddress, guarded only byrequire(msg.sender == owner). The ledger's code is not in the verified source, so buyers could not see the rules governing their balances or sells. renounceOwnershiponly freezes the ledger address; it places no limits on what the ledger contract does. The owner now reads as the zero address, which onlyrenounceOwnershipcan set.- PeckShield reported that the deployer swapped 100,100,100,100,100,100,100.1001 TPAD for 1,015.33 WBNB (about $240,000). The token's own
_totalSupplyis 1,000,000 TPAD, so a balance that large could only have come from the external ledger, the sole source of balances.
Protocol details
Evidence
- report PeckShieldAlert on X: Fake TrustPad $TPAD has dropped -100% twitter.com
- transaction BscScan liquidity removal transaction 0x0ccb4b81b587a0d81e0575020d857449c67c3ab0aeed0d732e2c5c3c6dc32fa0 bscscan.com
- transaction bscscan.com transaction 0xcf32…60cf bscscan.com
- address TrustPad (TPAD) verified source code on BscScan bscscan.com
- address bscscan.com address 0x2Ca8…b4fd bscscan.com
- analysis Sourcify match for 0xf9333D7A78f00bA4AEA964043D577c34AF2497f8 on BNB Chain repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
