SharkTeam: Analysis of the black industry chain of Rugpull factory

A number of Rug Pull incidents have occurred recently, and the SharkTeam security research team conducted a detailed analysis of these incidents. During the analysis, we found that the Rugpull factory contract on BNB Chain has initiated more than 70 Rugpulls in the past month. Next, we will analyze the source of funds, fraud behavior patterns, etc.

Due to space limitations, we will mainly analyze SEI, X, TIP and Blue token events. These tokens are created by the createToken operation of the token factory contract 0xDC4397ffb9F2C9119ED9c32E42E3588bbD377696.

In the createToken function, the following parameters need to be passed in when creating a token: token name, token symbol, accuracy, supply, token owner address, factory contract address for creating token pairs, and BUSD-T stablecoin address. Among them, the factory contract that creates the token pair uses PancakeSwap's factory contract, and each token has a different owner address.

1. Fund traceability

The owner addresses, symbols, and contract addresses for SEI, X, TIP, and Blue tokens are shown below. Among them, the owner addresses of X, TIP and Blue are:

0x44A028Dae3680697795A8d50960c8C155cBc0D74。

0x 44 A 028 Da funds come from 0x072e9A13791f3a45fc6eB6AD38e6ea258C080cc3, address 0x 0 a 8310 ec funds come from multiple EOA accounts and have a common address

0x072e9A13791f3a45fc6eB6AD38e6ea258C080cc3。

The following is the relevant information for the Token Factory contract 0x DC 4397 ffb 9 F 2C 9119 ED 9 c 32 E 42 E 3588 bbD 377696. This factory contract was created with the address 0x 1 dE 949 eac 4 b 5 fc 1 B 814 E 733 C D5 6 AE 65 DfF 1 bcEEF. The funds at the address 0x1dE949ea come from multiple accounts, and there is one source of funds at 0x 072 e 9 A 13791 f 3 a 45 fc 6 eB 6 AD 38 e 6 ea 258 C 080 cc 3 .

The source of funds for address 0x 072 e 9 A 13 is as follows: There is some fund interaction at address 0x 1 dE 949 ea. Other addresses have also created factory token contracts and are rug pullers for some tokens.

For example, 0x 04067 B 4 fcC 9 f 3d 99 aC 5211 cfE 8 d 3 e 8687 B 0401 d 3 is funded by 0x 6 ae 8 F 98830894518 c 939 B 0 D 0 A 5 EF 11 c 671 e 9 DFCa. And 0x6ae8F988 created the factory contract 0x e 83 EbBb 4 acc 3d 8 B 237923 Ee 33 3D 04 B 887 ca 1 a 008 . The factory contract also performs the same token creation behavior:

We selected one of the tokens for analysis and found that the token has Rug Pull behavior.

The funds for 0x6ae8F988 partly come from 0xa6764FBbbFD89AEeBac25FCbB69d3E9438395e57, and the funds for this address come from 0xE5A5c50980176Cc32573c993D0b99a843D77BC6E. The address 0xE5A5c509 is funded by the Tornado Cash address with a fund of 10 BNB. In addition to the funds provided by Tornado, there is also a portion of profits obtained through fishing and token Rug Pull.

Additionally, the above address played an important role in the subsequent pattern of fraudulent behavior at the Rugpull facility.

2. Rugpull Factory Fraudulent Behavior Model

Let’s take a look at the Rugpull factory fraud behavior patterns of SEI, X, TIP and Blue tokens.

（1）SEI

First, the SEI token owner 0x 0 a 8310 eca 430 beb 13 a 8 d 1 b 42 a 03 b 3521326 e 4 a 58 exchanged 249 SEI at the price of 1u.

Then, 0x6f9963448071b88FB23Fd9971d24A87e5244451A performed bulk buy and sell operations. Under the buy and sell operations, the liquidity of the token increased significantly, and the price also increased.

Promote it through phishing and other methods to lure a large number of users to buy. As liquidity increases, the token price doubles.

When the price of the token reaches a certain value, the token owner enters the market and performs a sell operation to perform rugpull. As can be seen from the figure below, the entry and harvest time periods and prices are different.

（2）X、TIP、Blue

First, the owner of X, TIP and Blue tokens 0x44A028Dae3680697795A8d50960c8C155cBc0D74 exchanged 1u for the corresponding tokens. Then, same as Sei token. 0x 6 f 9963448071 b 88 FB 23 Fd 9971 d 24 A 87 e 5244451 A Bulk buy and sell operations. Under buy and sell operations, liquidity increases significantly and prices rise.

Then it is promoted through phishing and other channels to lure a large number of users to buy. As liquidity increases, the token price doubles.

Like SEI, when the price of the token reaches a certain value, the owner of the token enters the sell operation to perform Rugpull. It can be seen from the figure below that the harvest time and price are different.

The fluctuation charts of SEI, X, TIP and Blue tokens are as follows:

We can know from the traceability of funds and behavior patterns:

In the fund traceability content, the founders of the token factory and the token creators’ funds come from multiple EOA accounts. There are also fund flows between different accounts, some of which were transferred through phishing addresses, some were obtained through previous token rugpull actions, and some were obtained through currency mixing platforms such as tornado cash. Using multiple methods to transfer funds aims to build a complex and intricate financial network. Different addresses also create multiple token factory contracts and produce tokens in large quantities. .

When analyzing the token Rugpull behavior, we discovered that the address 0x6f9963448071b88FB23Fd9971d24A87e5244451A was one of the funding sources. A batch approach is also used when operating token prices. The address 0x072e9A13791f3a45fc6eB6AD38e6ea258C080cc3 also acts as a fund provider, providing corresponding funds to multiple token holders. .

All in all, there is a Web3 fraud gang with a clear division of labor behind this series of actions, forming a black industry chain, which mainly involves hotspot collection, automatic currency issuance, automatic transactions, false propaganda, phishing attacks, Rugpull harvesting, etc., mostly occurring on BNBChain . The fake Rugpull tokens issued are closely related to hot industry events and are highly confusing and instigative. Users need to be vigilant at all times, remain rational, and avoid unnecessary losses.