What happened
ASTIR (ASTIR) is a BEP-20 token on BNB Smart Chain at 0x0081e8d4…c49c85, deployed on 15 May 2021 with 250,000,000 tokens credited to the deployer. Its transfer bookkeeping hides a trap inside a helper named setWallets: the recipient of the token's very first transfer is stored in a private variable _xowner, and every later transfer to that address reverts with "Recipient not found." When the first transfer is the deployer adding liquidity, _xowner becomes the PancakeSwap pair, so buyers can receive ASTIR from the pair but can never send it back to sell. The block is automatic and permanent; no owner call is needed and renounceOwnership does not remove it.
De.Fi's REKT database lists ASTIR as an exit scam/honeypot and describes it as an owner-controlled transfer block.
How it happened
- The constructor sets the deployer as owner and credits it the full 250,000,000 ASTIR supply with
setWallets(msg.sender,_tokenSupply). - Every
transferandtransferFromruns_transfer, which updates the sender's balance through the three-argumentsetWallets(sender, recipient, ...). - In that helper,
if(sender != address(0) &&_xowner == address(0)){ _xowner = recipient; }records the first recipient ever seen; every later call runsrequire(recipient != _xowner, "Recipient not found."). - Adding liquidity makes the router call
transferFrom(deployer, pair, amount). If that is the token's first transfer, the pair becomes_xownerand the liquidity deposit itself succeeds. - Buys send ASTIR from the pair to the buyer, which passes the check. Sells send ASTIR to the pair and revert, so bought tokens cannot be swapped back.
_xownerhas no setter, and onlygetBurnAddress, anonlyOwnerview, returns it, so the trapped address is not exposed through the public interface.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
