Detailed Analysis of Rug Pull Eyewash: An Examination of Common Scamming Techniques in the Decentralized Finance Field

In the cryptocurrency industry, Rug Pull has become one of the most common scams. Although many cases have been exposed, there are still many potential eyewash scams that have not been discovered. Data shows that there are at least 188,000 potential Rug Pull scam projects on major blockchains such as Ethereum and BNB Chain.

Distribution of Rug Pull Projects on Major Blockchains

Statistics show that about 12% of BEP-20 tokens on BNB Chain exhibit fraudulent characteristics, while about 8% of ERC-20 tokens on Ethereum show signs of fraud. Meanwhile, about $910 million in fraud-related ETH is processed through regulated cryptocurrency exchanges. According to other data, a total of 11 DeFi protocols were attacked in October 2022, affecting $718 million worth of crypto assets, setting a record for the highest monthly crypto loss that year.

As one of the largest platforms in the blockchain ecosystem, a well-known trading platform’s continuously expanding user base and new features may become a primary target for scammers and hackers. The platform seems to have realized the prevalence of smart contract scams on its network and has now integrated risk monitoring tools to detect risks in real-time and promptly alert users to potential risks such as Rug Pull.

Common Tactics of Rug Pull Projects

Rug Pull, also known as “fraudulent tokens” or “Decentralized Finance scams”, typically refers to projects that meticulously design code within smart contracts to steal funds from retail investors. The design goals of their code usually include:

1. Prohibit secondary sales
2. Allow project developers to freely mint new tokens
3. Charge the buyer a 100% sales fee

Scammers hide these scripts in tokens, and once uninformed retail investors purchase them, they face significant risks. In most cases, Rug Pull tokens appear no different from other cryptocurrencies and also adhere to the homogeneous token standards of blockchain, but the real problems are hidden deep within the smart contract source code.

With the development of the cryptocurrency industry, fraudsters have also mastered the underlying technology, enabling them to make extensive modifications to smart contracts. They often hard-code malicious rules into the smart contracts, not only granting themselves additional powers but also depriving buyers of their fundamental rights.

The general operation process of a Rug Pull project is:

1. Deploy a vulnerable token
2. Create a liquidity pool on the decentralized exchange
3. Establish trading pairs of tokens with other “legitimate” cryptocurrencies.
4. Manually creating a large number of transactions to exaggerate the value of the token
5. Attract retail investors to enter the market

In addition, Rug Pull projects may disguise their legitimacy in the following ways:

1. Create fraudulent websites and project development roadmaps
2. Promote false partnership relationships and display false information about well-known developers.
3. Advertise on social media

Once a sufficient number of users purchase the tokens, the eyewash will quickly sell off the tokens and exchange them for other mainstream cryptocurrencies. This large-scale sell-off in a short period of time will cause the token price to plummet to zero, completing the entire Rug Pull eyewash.

Rug Pull eyewash type

Currently, there are three main types of Rug Pull in the market:

1. Concealed deployment of honeypot vulnerabilities
2. Hidden private token function
3. Hidden Balance Modification Backdoor

Honeypot vulnerabilities often discourage token buyers from reselling, allowing only developers to sell their cryptocurrency holdings. Ordinary investors will receive an error message when trading and will not be able to withdraw funds. This type of scam often leads to a rapid increase in the price of the token in a short period of time, luring more users to buy. As of October 25, 2022, there are about 96,008 token projects in the market with honeypot vulnerabilities.

The private token function is one of the common methods used by scammers. They will give specific accounts permission to mint new tokens using hidden features in the token contract. When a scammer successfully invokes the minting function, they will acquire a large number of tokens and sell them in the market, causing the value of other holders’ tokens to depreciate significantly. As of October 25, 2022, there are about 40,569 token projects in the market with hidden private token minting functions.

The balance modification backdoor is similar to the private token creation function, where the scammers grant specific accounts the permission to modify the token holders’ balances. When these accounts set the holders’ balances to zero, the victims are unable to sell or withdraw, while the scammers can remove liquidity or mint and sell tokens for cash.

Conclusion

With the increasing number of crypto eyewash, investors need to carefully assess fraud risks when choosing crypto projects. At the same time, regulatory agencies should intensify their efforts to combat fraud, protect consumer rights, and enhance market integrity, transparency, and consumer protection standards. Only in this way can we build a safer and more trustworthy cryptocurrency ecosystem.