XCAD Rug Pull

What happened

XCAD (PLAY) was a BNB Chain token paired with BSC-USD on PancakeSwap. Its transfer logic blocks every sale and every wallet-to-wallet transfer while a canSell flag is false, and the flag starts false; only a _tokenOwner address set at deployment can toggle it or cap how much any single address may sell. Buying from the pool is never blocked, so the token can be bought but not sold unless that address allows it.

On April 11, 2023 CertiK reported that the deployer 0x8dCE7D8d…9773Ca removed liquidity in three transactions for a profit of about $100,000, and that the token appeared to be a honeypot.

How it happened

1. The constructor records a tokenOwner argument as _tokenOwner, mints the whole 100 million supply to it, and creates the pair against BSC-USD: _tokenOwner = tokenOwner; ... _mint(tokenOwner, total);. _tokenOwner is separate from the Ownable owner, so renouncing ownership (the owner is now 0x...dEaD) does not touch it.
2. bool canSell; has no initial value, so it starts false. changeCanSell() flips it and is gated only by require(_tokenOwner == msg.sender);.
3. In _transfer, a non-excluded transfer to the pair (a sell) hits require(canSell,"canSell");, and so does any non-excluded transfer that is neither a buy nor a sell. Transfers from the pair (buys) have no such check.
4. maxSellToken(address userAddress, uint256 tokens) lets _tokenOwner set a per-address cap enforced by require(_maxSell[from] >= _haveSell[from].add(amount), "maxSell");, so even with selling open a chosen holder can be limited to a tiny amount.
5. Only _tokenOwner can add liquidity (if(isAddLdx){ require(_tokenOwner == from); }), and addresses excluded from fees skip every sell check.
6. CertiK reported that the deployer removed liquidity in three transactions, profiting about $100,000, and flagged the token as a likely honeypot. De.Fi's listing gives 0x6bb3c129…8de6c3 as the liquidity removal transaction.

Protocol details

Classification Token

Protocol Type Exit Scam/Rugpull

Affected asset / contract PLAY

Evidence

• report @CertiKAlert incident report twitter.com
• report CertiK Alert post on XCAD (PLAY) liquidity removal twitter.com
• transaction bscscan.com transaction 0x6bb3…e6c3 bscscan.com
• address XCAD (PLAY) verified contract source, BscScan bscscan.com
• address bscscan.com address 0x8dce…73ca bscscan.com
• analysis Sourcify match for 0x2f8726192d599806E1EabBED1687E48e38E56489 (chain 56) repo.sourcify.dev