Vine Protocol Rug Pull

Reported loss Not disclosed
BNB Chain
Rugpull

What happened

Vine Protocol (VINE) was promoted in 2021 as a multi-chain DeFi platform with an airdrop of 500 VINE per participant. Its BNB Chain contract, 0x8044f846…1db6a2, is both the token and a built-in airdrop and token sale. tokenSale accepts any amount of BNB and hands out VINE from the contract's own balance, and a payable fallback also accepts plain BNB transfers without giving anything back.

All BNB collected stays in the contract until the owner, who received the full 100 million VINE supply at deployment, withdraws it with clearETH. The contract has no refund path and no link to any liquidity pool. According to the Quadriga Initiative case study, participants who completed the airdrop tasks were later asked to send 0.1 BNB or bring five referrals to receive their tokens, and the project falsely claimed a CertiK audit.

De.Fi's REKT database lists Vine Protocol as an exit scam; the total lost is unknown.

How it happened

  1. At deployment the constructor credits the whole 100,000,000 VINE supply to the owner; the airdrop and sale only work once the owner moves VINE into the contract's own balance.
  2. getAirdrop gives the caller aAmt VINE from the contract until aCap claims are used; the owner sets both with startAirdrop.
  3. tokenSale is payable with no minimum, cap check or on/off switch: it pays out sPrice * msg.value / 1 ether + 200e18 VINE from the contract and keeps the BNB. sCap is stored but never enforced.
  4. The contract's empty payable fallback also accepts BNB sent directly to it, with no tokens in return.
  5. clearETH lets the owner send the contract's entire BNB balance to itself at any time; nothing lets a buyer reclaim BNB.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract VINE
Protocol links Website

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.