Waronrug degen token Rug Pull

Reported loss $555
Ethereum
Rugpull

What happened

WORDegen (WORDegen, name t.me/waronrugdegentoken) was an Ethereum token with an 8,000-token initial supply, minted to the deployer. Its transfer and transferFrom functions contain a DevMode switch that is on by default and that only the deployer can toggle: while it is on, a transfer can only go through if the caller is the deployer wallet or the Uniswap V2 router, so wallet-to-wallet sends and pool payouts to buyers revert. On 2020-12-05 the deployer added 2 ETH and 7,600 WORDegen to a Uniswap V2 pool at 03:48:19 UTC (tx 0x7a30f424…582c2c) and burned almost all the resulting LP tokens to remove liquidity at 14:45:38 UTC, taking out 2.93402 ETH and 4,940.46 WORDegen (tx 0xfd42c400…a05b21).

De.Fi's REKT database lists the incident as an exit scam / rug pull with a 555 USD loss.

How it happened

  1. The constructor mints the whole 8,000-token supply to the deployer and records it as the only privileged address: _mint(msg.sender, _totalSupply); dev_wallet = msg.sender;. The flag bool public DevMode = true; is on from deployment.
  2. While DevMode is true, both transfer paths start with require(msg.sender == dev_wallet || msg.sender == uni_router);. A seller going through the router passes, because the router is msg.sender of transferFrom. A buyer receiving tokens from the pool does not: the pair sends tokens with transfer, its own address is neither the deployer nor the router, so the call reverts. The pair's payout of tokens on liquidity removal is blocked the same way.
  3. Only the deployer can switch the gate: function disableDevMode() public { require (msg.sender == dev_wallet); DevMode = false; } and the matching enableDevMode(). enableLimitMode() is also deployer-only and, once on, rejects any transfer above _maxTransactionTokens (800 tokens).
  4. Every transfer also burns 5% of the amount: uint256 OUTTokenDecay = value.div(tokenBurnRate); with tokenBurnRate = 20. The sender is debited the full value, the recipient is credited value - OUTTokenDecay, and _totalSupply is reduced by the decay.
  5. On 2020-12-05 at 03:48:19 UTC the deployer called addLiquidityETH on Uniswap V2 Router 2 with 2 ETH and 7,600 WORDegen and received 120.1666 UNI-V2 LP tokens at its own address (tx 0x7a30f424…582c2c).
  6. At 14:45:38 UTC the same address called removeLiquidityETHWithPermitSupportingFeeOnTransferTokens, burning 120.1424 LP tokens and receiving 2.93402 ETH and 4,940.46 WORDegen (tx 0xfd42c400…a05b21). Because the pair itself transfers tokens out during a removal, and the code blocks that while DevMode is true, the removal succeeding shows the gate was open (DevMode false) at that moment; the opened pages do not show which transaction turned it off.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract WORDegen

Evidence

Same attack technique

Browse all hacks →
Ethereum Farmland Network $892 lost Ethereum Pump Farm $478K lost Ethereum Twerk Finance $13K lost Ethereum Ba5ic finance $1K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes