Web Rug Pull

Reported loss $179K
Rugpull

What happened

Web (WEB) is a BNB Chain token at 0xC6E8b0A6…7604d6, deployed on 23 November 2023 by 0xc9975826…0b8f25, whose verified code stores no balances: balanceOf and every transfer are forwarded to a separate accounting contract that the owner points to with setAccountingAddress, and that contract's rules are not part of the verified source. It alone decides what each address holds and whether a transfer succeeds, so the token can show a fixed 1,000,000 WEB supply while the hidden contract credits any balance or refuses any sale. PeckShield reported on 24 November 2023 that 0xc997...8f25 swapped 100,100,100,100,100,100,100.1001 WEB, about 10^14 times the stated supply, for 921.36 WBNB (about $218K), dropping the price 100%.

The existing record describes the drain as a liquidity removal of 921.35 WBNB (about $217,791) with a net loss of $178,964, lists 0x18c903c1…b6c142 as the liquidity-adding transaction and 0xfb905622…a42260 as the drain, and says the funds were then spread across several addresses.

How it happened

  1. The constructor sets _totalSupply = 1000000 * 10 ** 9 and emits a Transfer from the zero address to the deployer, but writes no balance anywhere in the token contract.
  2. balanceOf returns Accounting(accounting).balanceOf(who). transfer and transferFrom emit a Transfer event first and then return Accounting(accounting).doTransfer(msg.sender, from, to, amount), passing the caller so the accounting contract can tell a router or pair apart from a wallet. A false return does not revert.
  3. The owner sets accounting with setAccountingAddress, and can replace it at any time until renounceOwnership, which leaves the address fixed. The owner reads as the zero address today.
  4. Because every balance and every transfer rule lives in the unverified accounting contract, holders cannot tell from the verified code whether they will be able to sell or whether other addresses hold far more than the stated supply.
  5. What happened: PeckShield reported that 0xc997...8f25, the deployer, swapped 100,100,100,100,100,100,100.1001 WEB for 921.36 WBNB. That amount is about 10^14 times the 1,000,000 WEB totalSupply, a balance only the accounting contract could have recorded.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract WEB

Evidence

Same attack technique

Browse all hacks →
RepubliK $121K lost Creso $154K lost DarkProtocol $174K lost TrustPad $56K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes