OAK — OnChain Attack Knowledge

Worked example · 2021

PancakeSwap token-impersonation wave — BSC — 2021

Loss
Distributed across hundreds of individual token-impersonation deployments. Individual victim losses ranged from tens to thousands of USD-equivalent per counterfeit token. The aggregate loss across the 2021 impersonation wave on PancakeSwap (BSC) is estimated in the low tens of millions of USD but is not precisely quantified due to the distributed, per-token nature of the extraction and the absence of a centralized victim-reporting mechanism.
OAK Techniques observed
OAK-T2.005 (Token Metadata Spoofing) — primary. Deployers created tokens whose name and symbol parameters impersonated legitimate projects (token-symbol squatting), exploiting PancakeSwap's token-listing-by-address model where users discover tokens via DEX search rather than a curated registry. OAK-T6.006 (Counterfeit Token Impersonation) — co-occurring. The on-chain artefact is a token contract with metadata matching a known brand; the T2.005 surface covers the deployment-side metadata deception; T6.006 covers the evasion-side brand-impersonation signal.
Attribution
pseudonymous — deployer addresses are on-chain attributable per token contract. Multiple deployers operated simultaneously; funding-source clustering linked subsets of counterfeit tokens to shared deployer addresses.
Key teaching point
PancakeSwap's permissionless token-listing model and BSC's low deployment costs made token-metadata impersonation trivially cheap: a deployer could create hundreds of impersonating tokens for a few dollars in gas, each targeting a different legitimate project's token symbol. The detection surface is the metadata-match signal (does this token's symbol match a known brand but its contract address differs from the canonical address for that brand?).

Summary

The 2021 PancakeSwap token-impersonation wave was a concentrated period of T2.005 activity on BSC during which deployers created hundreds of token contracts whose name and symbol parameters copied those of established DeFi tokens (e.g., "CAKE", "BUSD", "WBNB", "USDT"). The impersonating tokens were deployed on PancakeSwap — BSC's dominant AMM — where users discovered them via DEX search and mistakenly purchased the counterfeit, believing they were buying the legitimate token.

The attack exploited the gap between permissionless token deployment (anyone can deploy any token with any symbol) and user-facing token discovery (the DEX search UX that returns tokens by symbol match rather than by canonical-address verification). On centralized exchanges, token listings are gated by the exchange's listing-review process, which verifies the token's contract address and prevents symbol-squatting. On PancakeSwap and similar DEXes, no such gating exists — the deployer and the legitimate project compete for the same symbol-match space, and the user's ability to distinguish them depends on contract-address verification that most retail users do not perform.

Timeline (UTC)

When Event OAK ref
2021-02/03 BSC DeFi ecosystem expands rapidly; PancakeSwap becomes the dominant BSC AMM; token-deployment costs on BSC are low ($0.10–$1.00 equivalent) T2.005 (surface creation)
2021-03/06 Peak impersonation wave: hundreds of counterfeit tokens deployed targeting CAKE, BUSD, WBNB, USDT, and other high-volume PancakeSwap pairs T2.005 + T6.006
2021-06 PancakeSwap introduces token-warning UI elements and community-driven token-verification requests; impersonation tempo moderates but does not cease (mitigation)
Continuing Token-metadata impersonation remains an operational T2.005 surface on PancakeSwap and all DEXes with permissionless listing models — the structural condition is permanent (ongoing surface)

What defenders observed

  • Symbol-match clustering. Multiple tokens with the same symbol parameter ("CAKE", "BUSD") appeared in PancakeSwap's token search results, distinguishable only by contract address. Users who did not verify the contract address purchased the counterfeit.
  • Metadata-only impersonation with different tokenomics. The impersonating tokens typically had standard ERC-20 implementations with no relationship to the legitimate project — they were metadata-only clones. The token's transfer logic was normal; the deception was at the discovery layer (symbol match), not at the contract-interaction layer.
  • Deployer funding-source reuse. Deployers creating multiple impersonating tokens were linked by shared funding sources — typically BNB withdrawals from the same CEX deposit address, creating a per-deployer attribution signal.
  • Low per-token extraction, high aggregate. Individual counterfeit tokens extracted modest amounts (typically under $10K) before being identified and abandoned by the deployer. The aggregate extraction across the full wave was material when summed across all impersonating tokens.

Public references

  • PancakeSwap token list: community-maintained token-verification repository on GitHub.
  • BscScan: token-contract metadata verification and impersonation detection via "Similar Contracts" and token-name clustering.
  • GoPlus Token Security: automated honeypot and impersonation-detection heuristics covering PancakeSwap tokens.
  • Cross-reference: examples/2024-Q4-honeypot-token-cohort-cross-chain.md (cross-chain honeypot cohort, Q4 2024 — T1.004/T1.005/T1.006 anchor).

Techniques demonstrated (2)