Exposing Suspicious Transaction Activity in FAIRMOON Token
Highlights
- Outlining the “FAIRMOON incident”.
- Explaining the bug.
- A network of wallets sold FAIRMOON for 1.8 million USD leading up to War on Rugs’ bug announcement.
- The network of wallets has provable ties to the FAIRMOON developer team.
- FAIRMOON’s statement is dissected and questions are raised regarding it.
Overview and Timeline of the Incident
Launch
FAIRMOON is a Binance Smart Chain token forked from the popular SAFEMOON contract. At March 27 10PM UTC the token was listed on PancakeSwap and trading started. The token was launched from the DxSale platform where the presale was facilitated.
Audit
On the day of launch the FAIRMOON contract was audited by War on Rugs, a well known auditor. This garnered a lot of interest for the token and the price subsequently increased due to the exposure.
Partnership announcement
In the following days the FAIRMOON x War on Rugs partnership was announced and this naturally gave the token a lot of attention. On April 1 the price of the token reached 2 cents giving a market cap of almost 100 million USD.
Marketing activities
Moving forwards from April 1 the FAIRMOON team held various activities to gain exposure including a manual token burn and a token giveaway. These two events are crucial in connecting particular wallets to the FAIRMOON team.
Price crash
The token sustained substantial growth until April 7, when a major holder sold their position with a price impact of -49%. This was followed by a partial retracement. April 8, another selloff occured which had a price impact of -46%. These selloffs were seemingly caused by separate major holders.
Right before midnight April 8 (UTC) War on Rugs announced on their Twitter that a flaw in the FAIRMOON contract had been identified. Concerned by this, many holders began selling some or all of their positions. The price dropped by -73.5% before retracing.
The FAIRMOON Bug
FAIRMOON, being a fork of SAFEMOON, included automated routines in the contract where liquidity is added to the Pancakeswap liquidity pool. Every time liquidity is added, additional computation is needed which increases the cost of the transaction. For this reason, you can define a liquidity-add-threshold. This way, the contract can accumulate tokens and when the threshold is reached, half is sold to market and the pair is added to liquidity. This makes the transaction cost cheaper on average.
When FAIRMOON devs forked the contract, they changed the supply, but did not change the liquidity-add-threshold variable. This created a major flaw. Instead of selling small amounts often, the FAIRMOON contract was set up to accumulate until it had 5% of total supply before triggering. It would then sell half of this to market. The original SAFEMOON contract would sell in much smaller increments.
The error can be illustrated with a figure showing how the flawed contract keeps accumulating contrary to the working one which sells smaller amounts more often.
Looking at how severe the flaw is and how the liquidity trigger would cause a price impact of over 50%, as reported by War on Rugs themselves, one wonders how it got past their audit. However, this is not the point of the article.
The Suspicious Transactions
In this section we will map out a network of wallets with provable ties to FAIRMOON developers. We will assume 500 USD/BNB and 2100 USD/ETH for calculations.
Initial accumulation
Directly after the Pancakeswap listing, a wallet proceeded to accumulate about 500 million FAIRMOON tokens equating to 10% of total supply. This was spread over about 20 transactions, the oldest which is here. (The start of page 1 and the entirety of page 2.)
The initial network consists of a wallet holding 500 million FAIRMOON tokens. We will refer to this wallet as the “central wallet”.
In this section we will detail the network of wallets where each node represents a wallet. Nodes will contain their respective FAIRMOON and BNB holdings, and edges will describe transactions. For the wallet addresses we will use a shorthand format using the last four characters of the address e.g. “…373c” means “0x485d2F761089b01623d3d6d31fd06e7C75d0373c”. This way you can verify the linked BSCscan transactions against the figures.
There might be some rounding errors in the analysis as smaller buys, sells and transactions were made by the network, irrelevant to our analysis. There are also distribution to holders which increase the wallets’ size without any transactions occuring. Links to the relevant transactions for reference are provided in-text as hyperlinks.
Dispersion of funds
Shortly after accumulating the funds, the central wallet dispersed the funds into four “satelitte wallets”. This was done in four transactions: 1, 2, 3 and 4.
The network now looks like this:
The manual burn event
FAIRMOON held a manual burn event on April 1. They burned 100 million FAIRMOON tokens as a compensation for a “whale that dumped”. Looking at the transaction we see that it was sent by “…25c5” in the network.
Filtering FAIRMOON transactions by the “…dead”-address we see that the only address that sent this magnitude of funds was in fact “…25c5”. This way we can tie the tweet to the wallet and thus we tie the FAIRMOON devs to the network of wallets.
The network now looks like:
Giveaway
Following the burn event a giveaway was held. The winners were announced and asked to get in touch to receive 10 million FAIRMOON tokens each. Prior to the giveaway the central wallet had bought tokens to facilitate it. We will not be including these transactions in our analysis as they are relatively small.
Winners would receive half upon announcement and the rest when FAIRMOON’s IDO platform would launch. Two transactions matched the size of 4.9 million tokens which equates to 5 million before tax fees. Transaction 1 and 2. The transactions stem from the central “…373c” wallet.
With these two transactions we gain more confidence that the entire network is associated with FAIRMOON developers and not just a satelitte node.
The network now looks like:
First network selloff
April 7 around 3 PM UTC we see the first selloff from the network. Note that this is almost two days prior to War on Rugs announcing the bug on their twitter.
Through two transactions, 1 and 2, “…0d0b” sells a total 90 million FAIRMOON tokens for 1162 BNB or 581,000 USD. At this point, the wallet still held 59 million FAIRMOON tokens.
The network now looks like:
Second network selloff
The following day, April 8 3 PM UTC, we witnessed another massive selloff by the wallet network. This time, the network would sell virtually all of its holdings. This also occured well in time before the War on Rugs announcement, which came about 9 hours later the same day.
The selloff included four transactions with 61 million, 133 million, 3 million and 114 million FAIRMOON tokens sold by the four satelitte wallets. The wallets received 694, 937, 37 and 761 BNB from this, respectively. In total this is 2429 BNB or just over 1.2 million USD. In total the satelitte wallets had accumulated 3591 BNB which equates to roughly 1.8 million USD.
The network now looks like this:
BNB returned to central wallet
Following each selloff from the satelitte wallets the funds were then sent back to the central wallet:
- For wallet “…0d0b” this is done in two transactions, 1 and 2. One at each sell event.
- For wallet “…ee0b” this was done in a single transaction.
- For wallet “…25c5” this was done in a single transaction.
- For wallet “…4e3e” this was done in a single transaction.
The network now looks like this with all funds transferred back to the central wallet:
BNB swapped for ETH
Later, the day of the second selloff, War on Rugs announced the bug and a price crash followed. In the hours surrounding this the wallet of interest was busy swapping BNB into Binance-pegged Ethereum. By filtering the BEP20 ETH transactions by the central wallet’s address we can see the swap events. A total of roughly 1000 ETH was accumulated by the central wallet accounting to 2.1 million USD!
Note: The discrepancy between this number and the 1.8 million USD cited earlier is caused by a “smaller wallet” in the network. This wallet sold in relatively small amounts on the April 7 together with the network selloff. However, the BNB was never returned to the central wallet and is therefore not included in the main wallet network. There was a 390 BNB transfer to the central wallet on April 2 so the wallet we missed is still associated with the network. The 390 BNB can however not be traced back to selling FAIRMOON tokens to market.
ETH deposited to Binance
After swapping BNB for ETH, the network branches out into several smaller wallets. These wallets distribute ETH to a number of addresses, some of which are Binance accounts. It is almost infeasible to trace all of this, but the effort might be undertaken in a later article. We can however provide examples:
- 50 ETH sent from central wallet to unknown wallet. The amount is split up into five and sent to wallets 1, 2, 3, 4 and 5. Wallets 1, 2 and 4 can be confirmed to be Binance deposits.
- 50 ETH sent from central wallet to unknown wallet. The amount is split up into five and deposited to Binance in transactions 1, 2, 3, 4 and 5. Wallets 1, 2, 4 and 5 can be confirmed as Binance deposits.
- 50 ETH sent from central wallet to unknown wallet. The amount is split up into five and deposited to Binance in transactions 1, 2, 3, 4 and 5. Wallets 3 and 4 can be confirmed as Binance deposits.
You can confirm for yourself which wallets are Binance deposits by seeing if “Binance: Hot Wallet” is making withdraws from the receiver. You can trace the 1000 ETH yourself by looking at BEP20 ETH transactions filtered by the central wallet.
The chart
We have annotated the FAIRMOON price chart to show how each of the events affected price.
Recap
In this section we have demonstrated that a wallet network with provable ties to the FAIRMOON developers sold FAIRMOON tokens prior to the War on Rugs bug announcement. The token sell netted the network 1.8 million USD! These funds have then been dispersed into multiple wallets, some of which were Binance deposit addresses.
FAIRMOON’s Statement
Following War on Rugs’ announcement, FAIRMOON posted a statement on their Telegram Announcement channel where it can be found in full. We will review specific claims from the statement and identify questions that are raised, based on information presented here.
The statement itself describes the role of a fairmoon developer, Miley, who allegedly betrayed the developer team.
As the community grew rapidly, Miley helped form our partnership with WarOnRugs and was our main point of contact between both communities. The majority of our leadership and community only heard about the project and joined after the partnership was announced
As we kept growing, Miley mostly worked independently on different aspects of the project and relayed updates with the team. She directly developed our current website under her ownership, and coordinated our Twitter giveaway with the generosity of our larger holders.
Miley has been in charge of the War on Rugs partnership, worked independently on “different apsects” of the project and only relayed information to the rest. She also coordinated Twitter giveaways with the help of “generous large holders”.
Note that the statement makes no mention of the burn event and who was generous enough to burn 100 million FAIRMOON tokens. The tweet however cites that “we (read: FAIRMOON team) have burned 100 million tokens”. The giveaway was also only attributed to “generous large holders” in a statement long after the giveaway happened.
The next section outlines “The Betrayal”
After our original Fairmoon contract developer found an economic bug in our liquidity protocol, he carefully brought it to our top leadership’s attention to Tommy, then No Mercy, then eventually Miley. When Miley understood the issue, she shared this information with her large holder contacts, then WoR, and dumped her bags on us, going radio silent, and deleting her account. WoR relayed the bug information immediately on twitter.
This sequence of events seems to add up with our analysis, but the timeframe is obscured. At this point, we are forced to assess the truthfulness of various statements by the parties involved. If we assume that War on Rugs immediately disclosed the bug, the length of time between Miley sharing details of the bug with her “contacts” and Miley informing War on Rugs of the same is at least 30 hours. This is evidenced by the length of time between the first insider selloff and War on Rugs’ statement, as shown on the chart. It is safe to assume that when funds are shared within a network, information is also shared. Therefore, a sell from a member of the network likely indicates that the entire network was aware of the bug.
It seems that either War on Rugs or FAIRMOON developers withheld the bug information for up to 30 hours. Assuming War on Rugs immediately disclosed the information, it is FAIRMOON which withheld the bug information.
We soon discovered that she ran off to form SAFEFAIRMOON, to continue milking the situation from the chaos she started. This copycat clone is intended to make a mockery of both our project and WoR
This is patently false. The members of SafeFairMoon have known one another previous to their involvement in this project, and none of us have had any involvement in FAIRMOON.
In this article we have outlined how you have been lying to everyone. Please provide proof this is not just another one of your lies.
To be perfectly clear one or more members of FAIRMOON has scammed and soft rugged their own investors while trying to defame our project. We are speaking up for the sake of FAIRMOON investors and the crypto space as a whole.
The WoR team is developing the new contract and swap solution concerning the economic liquidity protocol issue found in our contract to protect the capital from both communities, since that is the number 1 priority. After they ensure a successful migration, they will renounce the ownership of the contract like our previous contract.
Protecting capital is “the number 1 priority”, but no concern is raised for the 1.8 million USD withdrawn from FAIRMOON’s liquidity by potentially only a single person.
Conclusion
We have demonstrated that the wallet network was connected to the team by their own admission (burn and giveaway) and that it profited by removing roughly 1.8 million USD of liquidity from FAIRMOON. It also appears that they were aware of the bug for at least 30 hours prior to its disclosure by War on Rugs. There are, however, some important outstanding questions:
- Who was the 500 million FAIRMOON wallet and what role did they play in FAIRMOON?
- Did more than one of these wallets belong to Miley? If the network has multiple owners, this suggests that Miley is not the only culprit.
- With respect to the above, who burned the 100 million FAIRMOON tokens? This was never attributed to “generous large holders”, the team took responsibility for it. Was this Miley?
- Who really discovered the contract bug?
- Why did FAIRMOON developers sit on the bug information for at least 30 hours without disclosing it publicly or to their partner, War on Rugs?
- Why has neither FAIRMOON developers nor War on Rugs, as their partner, addressed the magnitude of capital withdrawn by a select few, through selling?
- Why are FAIRMOON developers not indicating that they will try and recover the lost funds? They should take seriously what amounts to a theft of 1.8 million USD taken from their liquidity, and we are shocked that their public response has not indicated such an effort.
So you be the judge. Believe the blockchain verified fraud complete with multiple wallets and time stamps, or some story about a Miley character.
We hope this article will be of help to FAIRMOON’s investors and partners going forward.
