Original | Odaily Planet Daily
Author | Nanzhi
Token Pixiu usually refers to a situation where a token can only be purchased but not sold, and the developer will remove the LP to make a profit after a period of time, and Rug Pull the buyer. Delayed Pixiu means that the token can be traded for a short period of time after it is opened for trading, and then it becomes a Pixiu state. For this type of Rug Pull technique, many contract detection tools have not yet added corresponding detection functions, which is becoming one of the main profit-making methods for malicious developers.
Below, Odaily Planet Daily will explain how the delayed Pixiu is implemented by briefly summarizing the principles of ERC 20 and Uniswap.
Note: Some analogies in the article are for ease of understanding and are not completely rigorous.
ERC 20 Basics
Most tokens on the market comply with the ERC-20 standard. What is ERC-20? ChatGPT’s answer is as follows:
ERC-20 is a token standard on the Ethereum blockchain that defines a set of rules and interfaces that token contracts must follow. This standard specifies the basic functions of tokens, including transfers, balance inquiries, authorization to spend tokens on behalf of others, etc.
Here are some of the main ERC-20 token standard rules and features:
Transfer: ERC-20 tokens can be transferred through smart contracts, allowing users to send tokens to other Ethereum addresses.
BalanceOf: Users can query their ERC-20 token balances to see how many tokens they own.
BalanceOf:
In fact, this function not only has the "query" function, but also defines how many tokens a user "owns". Each token can be understood as a "bank", and after trading tokens, each wallet address obtains a "savings card" from the "bank", which records the balance of each address. Users can apply to the bank to query their balance, or submit asset change requests to the bank for transactions.
Note: Ethereum adopts the Account-Based model.
Therefore, users do not essentially "own" their assets, but rather a function "defines" the number of tokens you can "spend".
That is: X tokens Balance Of [A account] = the number of X tokens that A account can spend externally
Note: Bank deposits in the real world are the bank’s debt to its customers, and the bank has ownership of the assets.
Transfer
All ERC-20 tokens need to complete the transfer function. Based on the previous ledger model, when a transfer occurs, it is not that account A "delivers" a token to account B, but that X number of tokens is deducted from account A and X number of tokens is added to account B.
That is: Balance Of [A Account] - X and Balance Of [B Account] + X
Developers can modify the transfer function to restrict the transfer amount, transferor, etc.
The transfer function is the fundamental source of most Pixiu mechanisms.
Uniswap
The previous section likened each token to a "bank", so Uniswap can be understood as an acceptance middleman, exchanging two tokens through the AMM principle of xy=k.
The exchange process is as follows:
User transfers token A to Uniswap contract
Uniswap will calculate the tokens to be returned by y=k/x and deduct the handling fee
Uniswap transfers token A to the LP pool and withdraws token B
Uniswap transfers tokens to users B
Of course, Uniswap actually involves multiple functions and processes. The key point to understand here is that Uniswap only trades based on "received tokens", and when the user performs a "transfer" operation, the quantity may have changed.
Pixiu Mechanism
In this section, the Pixiu mechanisms are divided into two categories:
① High transaction taxes, resulting in users not receiving payment for selling tokens;
② Unable to transfer funds, resulting in users being unable to trade with Uniswap.
High transaction taxes
This section shows the calculation process of a Meme coin with transaction tax as shown in the figure below (focus on the red part only).
Calculate transaction tax(s)
Deduct the full amount from the user's wallet (BalancerOf[user] reduces tokens A)
Transfer to developer wallet or LP address (BalancerOf[Dev] increases token A × tax S)
Transfer some tokens to Uniswap to exchange for token B (token A×(1-S))
User received insufficient tokens B
As mentioned in the previous section, Uniswap only processes "received tokens", and developers can arbitrarily modify the amount transferred to Uniswap and users.
Here, if the transaction tax rate is changed to 100%, the Pixiu is implemented in the third step "③ Transfer to the developer wallet or LP address", and the user can no longer receive tokens.
Unable to transfer funds
In Solidity, developers can restrict transactions through require:
If the developer restricts the exchange of tokens to certain whitelist addresses, users will not be able to send their tokens to Uniswap. In the second step "② Deduct money from the user's wallet", the Pixiu is implemented, and the developer can set the Uniswap Router to send tokens. The result is:
Users can only buy (Uniswap transfers tokens to users), but cannot sell (because tokens cannot be transferred to Uniswap to exchange for ETH, etc.).
Alternatively, developers can set the transfer limit to 0, turn off the transaction switch, and perform other operations, but ultimately they are all controlling the "transfer" behavior.
Delay Pixiu
A further delay in Pi Xiu is achieved by requiring a limit on time (block height).
For example, in a certain token, the restrictions are as follows:
require（block.number < _allowance）
As the block height increases, when it reaches a certain threshold, users will not be able to transfer money, thus realizing the Pi Xiu.
In addition, there are Pi Xiu that are realized by reaching a certain threshold of transaction times. When this type of delayed Pi Xiu is checked by certain contract security detection tools, if there is no targeted setting, it can be traded normally under the initial circumstances, luring users into the trap.
How to prevent it
Given that this type of harvesting method is common among "earth-rushing dogs", buyers often pursue efficiency and ignore safety, and we have not yet seen any mature security company launch special detection tools for this method. Therefore, Odaily Planet Daily reminds that buyers with certain coding skills should go through the contract code (or use tools such as ChatGPT for a quick look) for their own assets, pay special attention to the selpair contract, and stay away from projects containing uncommon code areas.