USEA Token Rug Pull

What happened

USEA Token (USEA) is a BNB Chain token deployed on 14 March 2023 at 0xdf7ff95a…cf1b1a. It starts with a supply of zero, and its only issuance path is an owner-only mint with no cap that credits new tokens to the caller. According to NumenAlert, the deployer and owner 0x11eb8c55…7a5dc7 minted 867 million USEA, moved them to 0xc88727cd…99144a, and sold them on PancakeSwap V3 for about 1.1 million BUSD, draining the pool's BUSD side.

De.Fi's REKT database puts the proceeds at $1,114,468 and says they were then spread to other addresses, naming 0x3c3eAFa8…e96CfB as the funds holder.

How it happened

1. The constructor sets _totalSupply = 0; and makes the deployer 0x11Eb8c55…7a5DC7 the Ownable owner, so no tokens exist until the owner mints them.
2. mint(uint256 amount) public onlyOwner calls _mint(_msgSender(), amount), which adds amount to _totalSupply and to the owner's balance with no maximum and no timelock.
3. USEA traded in a PancakeSwap V3 pool against BUSD, so the pool held BUSD that any USEA seller could take out by selling tokens into it.
4. According to NumenAlert, the deployer minted 867 million USEA, transferred them to 0xc88727cd…99144a, and that address sold them into the pool for about 1.1 million BUSD, leaving existing holders with tokens the pool could no longer buy back at the earlier price. De.Fi's REKT database lists the mint as 0x4e889ed2…98e417, the transfer as 0x30a1ceb1…074d09 and the largest drain as 0x4cd009dd…b2eb20.
5. renounceOwnership() exists in the contract, but on-chain owner() still returns the deployer, so the unlimited mint remains available.

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract USEA

Evidence

• report @NumenAlert incident report twitter.com
• report NumenAlert post on the USEA rug pull twitter.com
• transaction USEA contract creation transaction bscscan.com
• transaction De.Fi REKT database entry for USEA (write-up with address and transaction list) de.fi
• transaction bscscan.com transaction 0x30a1…4d09 bscscan.com
• transaction bscscan.com transaction 0x4cd0…eb20 bscscan.com
• transaction bscscan.com transaction 0x4e88…nbsp bscscan.com
• address USEA Token (USEA) verified contract code on BscScan bscscan.com
• address bscscan.com address 0x11eb…5dc7 bscscan.com
• address bscscan.com address 0x3c3e…6CfB bscscan.com
• address bscscan.com address 0xc887…144a bscscan.com
• analysis Sourcify match for 0xdf7ff95aa3d855a6fb21399432166a92fdcf1b1a on BNB Chain repo.sourcify.dev