Background

in the previous issue Web3 Security Getting Started Guide to Avoiding Pitfalls, we analyzed common fake mining pool scams. In this issue, we will focus on the Pixiu Pan scam. According to legend, Pixiu is a magical creature, and it is said that treasures swallowed cannot be taken out from its body. This image aptly describes the Pixiu Pan scam: after users invest money, the price rises rapidly, triggering follow-up purchases, but ultimately finds that they cannot sell and the funds are locked up.

The content of this issue includes the reasons why users fall into Pixiu Pan, typical tricks of Pixiu Pan scam, and corresponding safety suggestions. I hope it can help everyone be more vigilant and avoid pitfalls.

Reasons for falling into the Pixiu disk

Let’s first take a look at some common reasons why users fall into the Pixiu market:

Imitation disk

Not only are there counterfeit coins in the real world, there are also counterfeit coins in virtual currencies. Some imitation projects will copy the names and logos of well-known projects and create token contracts with the same name. Users may mistakenly enter the Pixiu market without carefully checking the contract address of the token, and end up in a dilemma where they cannot sell.

“Race” mentality

Some users know that the project is unreliable, and have even noticed something suspicious in it (the bars of the candle chart are consecutive green), but they have a fluke mentality of “running fast and everything will be fine”. In fact, they basically cannot get out after entering. . Users originally thought that they could buy quickly in an upward trend and then sell at the right time. Wouldn’t that be a sure profit without losing money? But when they try to sell, they are either completely inoperable or can only sell a very small amount of tokens.

Investing induced by scammers

Another common situation is that users are seduced by the scammer’s rhetoric and then invest in Pixiu Pan. A victim of the Pixiu Pan scam described his experience: “I asked a question in the Telegram group, and someone enthusiastically answered a lot of my questions and taught me a lot. After we chatted privately for two days, , I thought he was pretty good, so he proposed to take me to the primary market to buy new tokens and buy them on PancakeSwap. He provided me with the contract address of a currency. After I purchased it, the currency kept rising. He told me that this was a golden opportunity that only occurs once in half a year, and suggested that I increase my investment immediately. I felt that things were not that simple. Taking his advice, he He kept urging me. Once I realized that I might have been deceived, I asked other people in the group to help me check. It turned out that it was indeed a Pixiu coin. I also tried it and could only buy it but not sell it. When the scammer found out that I couldn’t sell it. When he added more positions, he also blacklisted me.”

Pixiu plate typical routine

After understanding the common reasons why users are scammed, let’s take a look at how Pixiu Pan scammers operate the scam. The scammer first deploys a smart contract with a trap, and then uses social marketing, solicitation and other operations to throw out high-profit bait to attract users to buy. Some scammers also send the tokens they hold to wallets and exchanges, creating the illusion that many people are participating, or deliberately transfer coins to the addresses of crypto KOLs to give the illusion of celebrities buying.

After users purchase Pixiu coins, they usually see the tokens appreciate rapidly, so they want to wait until the tokens increase enough before trying to redeem them. However, the contract itself restricts users from selling in a variety of ways:

Add buyer address to blacklist

Once the victim purchases Pixiu coins, the scammer will blacklist the user’s address and restrict selling operations. Let’s take the Pixiu coin GROKAI as an example to see how scammers add users to the blacklist so that users cannot sell tokens.

The address of the GROKAI deployer is 0x2052C307a5e6d50F6a908a91fF7e605Eb0e0a2EC. After the scammer created the Pixiu coin GROKAI, he changed the Router of the GROKAI token to the Aontroller contract address. 0x7a85810414C3311A45486b03ceCCD3a32590E61E, why do scammers do this?

We looked at the Aontroller contract code and found that the contract owner could blacklist the address by calling a function, preventing users from selling GROKAI tokens.

Change the number of tokens in an address

Scammers can also manipulate the user’s token balance through smart contracts, changing the user’s token balance to an extremely low value and only recording it inside the contract. This operation will not update the balance on the blockchain explorer, which means that users can still see the tokens they hold on the blockchain explorer, but they cannot actually sell tokens that exceed the number recorded in the contract.

Set sell threshold

Some Pixiu boards allow users to sell tokens, but there is a selling threshold that requires users to exceed the set number of tokens before they can trade. Sometimes this threshold is set very high, exceeding the actual holdings of users, or high transaction taxes are attached. A more cunning way is to adjust the threshold dynamically. For example, if the user has 1000 coins, when the user tries to sell, the minimum threshold may be set to 1200 coins. In order to meet the selling conditions, the user will further buy Pixiu coins, but when the user’s holdings reach 1,200 coins, the threshold is raised to 1,400 coins. In this cycle, the user will never be able to meet the selling conditions.

Summarize

In this issue, we analyze the reasons why users fall into Pixiu Pan and the typical tricks of Pixiu Pan, hoping to help everyone understand and identify this type of scam. To avoid accidentally entering the Pixiu plate, users can take the following measures:

• Understand relevant virtual currency information, evaluate the background of project parties, and improve self-prevention awareness. Be wary of virtual currencies that offer high returns. Ultra-high returns usually mean greater risk.
• Use MistTrack to view the risk profile of related addresses, or use GoPlus’ Token Security Detection Tool to identify Pixiu coins and make trading decisions.
• When searching for tokens, you should search for the contract address rather than the token name to avoid falling into the trap of imitating the market.
• Check that the code has been audited and verified on block explorers such as Etherscan, BscScan and refer to community reviews.

Disclaimer：

1. This article is reprinted from [Slow Mist Technology], All copyrights belong to the original author [SlowMist Security Team]. If there are objections to this reprint, please contact the Gate Learn team, and they will handle it promptly.
2. Liability Disclaimer: The views and opinions expressed in this article are solely those of the author and do not constitute any investment advice.
3. Translations of the article into other languages are done by the Gate Learn team. Unless mentioned, copying, distributing, or plagiarizing the translated articles is prohibited.