Xai Rug Pull

Reported loss $581K
Rugpull

What happened

This XAI token on BNB Chain (0x1D152e63…815c81, deployed on 4 January 2024) copied the name of the Xai gaming token and is unrelated to it. Its constructor mints 6,000,000 XAI and comments that _mint "CANNOT be called ever again", yet the contract adds an owner-only mint(address to, uint256 amount) with no cap. As deployed, the sell fee is set to 1000 (percent), so any sale by a holder who is not fee-exempt reverts, while the owner is exempt.

PeckShield reported that the deployer 0xB3Ff5538…0847DD swapped about 2.08 trillion XAI, more than 300,000 times the constructor supply, for about 219,516 BSC-USD, sending the price down 100%. De.Fi's REKT database records the loss as 580,959 USD removed from the PancakeSwap pool in two liquidity removal transactions (0x19ba3032…a48f22 and 0xfa5454fc…6923fc), with proceeds sent to 0x484fd20d…6C1f6B and held as BUSD at 0x1e33e335…8B9FbA as of 13 January 2024.

How it happened

  1. The constructor mints 6,000,000 XAI to the deployer, excludes the owner from fees and limits, sets both fee wallets to the deployer's address, and sets _sellMarketingFee = 1000 with a buy fee of 0.
  2. On a sell to the pair by a non-exempt holder, fees = amount.mul(sellTotalFees).div(100) is ten times the amount. The contract tries to move fees from the seller and then runs amount -= fees, so the sale reverts: buyers can buy but cannot sell. updateSellFees can later lower the fee, but its cap is sellTotalFees <= 100, which still allows a 100% sell fee.
  3. The owner holds an uncapped mint(address to, uint256 amount) external onlyOwner, contradicting the constructor comment. Tokens minted to the owner can be sold without the sell fee because excludeFromFees(owner(), true) exempts the owner.
  4. manualBurnLiquidityPairTokens also lets the owner move up to 10% of the pool's XAI to the dead address every 30 minutes and call sync(), which raises the XAI price inside the pool without any trade.
  5. PeckShield reported that the deployer swapped 2,077,982,891,807.9 XAI for about 219,516 BSC-USD. Because the constructor supply is 6,000,000 XAI and mint is the only other function that creates tokens, that sale is consistent with owner-minted supply; the on-chain totalSupply now reads about 5.56 × 10^21 XAI.

Protocol details

Classification Token
Protocol Type Exit Scam/Rugpull
Affected asset / contract XAI

Evidence

Same attack technique

Browse all hacks →
JohnLennonC0IN $11K lost LongNoseDog $310K lost Pike Finance $55K lost Ordinal DEX $73K lost

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes