Apollo Swap Honeypot

What happened

ApolloSwap (APOLLO) was an Ethereum token whose contract lets the owner switch selling off for everyone except the Uniswap pair, the router, the owner and wallets the owner whitelisted. Once the switch is on, a holder's sell reverts with a misleading "transfer from the zero address" error. On 2020-12-06 the deployer whitelisted wallets, added 100 ETH of liquidity, and two minutes later turned the restriction on.

Six hours after that, the deployer removed the liquidity for 151.58 ETH and 27,068.2 APOLLO, a net gain of about 51.6 ETH, which fits De.Fi's listed loss of about $31K.

How it happened

1. The constructor sets both control slots to the owner and mints the whole supply there: _address0 = owner; _address1 = owner; _mint(_address0, initialSupply*(10**18));. While the two slots are equal, transfers are unrestricted.
2. Every transfer runs _ints, which, once the slots differ, allows only certain senders: if(recipient != _address0 && sender != _address0 && _address0!=_address1 && amount > _zero){require(sender == _address1 ||sender==_router || _Addressint[sender], "ERC20: transfer from the zero address");}.
3. The owner flips that switch with ints(address addressn), which only does require(msg.sender == _address0, "!_address0");_address1 = addressn;. With _address1 set to the pair, buys (sender = pair) still work, but a holder's sell (sender = holder) reverts.
4. multiaddress lets the owner send tokens and whitelist the first AllowN receivers through _Addressint[receivers[i]] = true;. Those wallets keep the ability to sell.
5. On 2020-12-06 deployer 0xAbbf27dA…Ec6a49 called multiaddress at 04:56 UTC (0x11e716fe…79f053) and added 100 ETH of liquidity at 05:08 (0xdf58bf19…aec463). At 05:10 it called ints(0x8b48671bb78a1e4a7f1fec0292763859706a5e87) (0xc4539257…95807d).
6. At 11:08 UTC the deployer burned 2,023.82 UNI-V2 LP tokens through removeLiquidityETHWithPermit (0x0278983f…d5559b), receiving 151.58 ETH and 27,068.2 APOLLO.

Protocol details

Classification Token

Protocol Type Exit Scam/Honeypot

Affected asset / contract APOLLO

Evidence

• report @CaptainJackAPE incident report twitter.com
• transaction Etherscan transaction 0x0278983f... (removeLiquidityETHWithPermit) etherscan.io
• transaction Etherscan transactions list for 0xAbbf27dA19c48Dd79e54f32eB0e634441CEc6a49 etherscan.io
• transaction Etherscan transaction 0xc4539257... (ints) etherscan.io
• address ApolloSwap (APOLLO) ERC20 contract source, Etherscan verified code etherscan.io
• analysis Web Archive archive.ph
• analysis Sourcify repository: chain 1, 0xaAE57e4D862B10B3037B67FFC28CbF1083A08dB7 (browser/Erc20Token.sol) repo.sourcify.dev