White Moon Finance Rug Pull

Reported loss Not disclosed
Rugpull

What happened

Every transfer of the MOON token takes a hard-coded 12% fee. _transfer debits the full amount from the sender, credits the recipient with 88% and credits the other 12% to 0x0ECDC7f2…04A3E0, the address that deployed the contract. The fee has no setter or exemption list, so it applies to buys, sells and wallet-to-wallet transfers alike.

The owner can also call mint to create new tokens for itself with no cap. De.Fi's REKT database lists the token as an exit scam/rugpull dated 2021-09-07; the code shows the fee and the mint power, not whether the mint was used or liquidity was removed.

How it happened

  1. _transfer computes the fee: uint256 fee = amount.mul(12).div(100); and fixes the recipient: address feerecipient = 0x0ECDC7f21908Ec9f7E593D09Bc2B8DF3f504A3E0;. Both transfer and transferFrom call _transfer, so no path avoids it.
  2. The sender is debited the full amount (_balances[sender] = _balances[sender].sub(amount);), the fee address is credited (_balances[feerecipient] += (fee);) and the recipient receives amount.sub(fee). Sending 100 MOON credits 88 to the recipient and 12 to the fee address. A liquidity pair receiving a sale gets 88% of the amount sold.
  3. The event log overstates the recipient's credit: emit Transfer(sender, recipient, amount); logs the full amount even though the recipient was credited only amount.sub(fee), and the separate emit Transfer(sender, feerecipient, fee); is logged on top.
  4. function mint(uint256 amount) public onlyOwner returns (bool) { _mint(_msgSender(), amount); } adds to the owner's balance and to _totalSupply with no maximum. The owner can therefore create tokens and sell them into liquidity; the code allows this but no transaction was opened that shows it happening.
  5. transferOwnership and renounceOwnership exist, so the mint power can be moved or given up, but nothing in the code forces that.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract MOON
Protocol links Website

Evidence

Same attack technique

Browse all hacks →
PenginFinance Token Loss not disclosed BNB Chain PePe Coin Loss not disclosed Red Eagle Token Loss not disclosed Stonks Token Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes