What happened
AurataGoldCat (AUGC, 9 decimals) limits transferFrom to one hard-coded address: require(from == _owner, "You are not the owner!");. A decentralized-exchange sale moves the seller's tokens through transferFrom, so for every holder other than that address the call reverts, while transfer has no check, so purchases paid out by a pool and wallet-to-wallet sends are not affected. The address in _owner is the deployer, 0x4C31d7FE…d282D5, and the source has no function that changes it.
The comment block at the top of the source describes a 10% tax (5% to holders, 5% to liquidity), but the code contains no fee logic: transfer moves the full amount. De.Fi's REKT database lists the token as an Exit Scam/Honeypot and describes it as: the contract owner could disable the transfer function, which restricted users in selling their tokens. The listing dates the incident 2021-06-13 and gives no loss figure.
How it happened
- The constructor sets
name = "AurataGoldCat",symbol = "AUGC",decimals = 9and_totalSupply = 1000000000000000000000000(1e24 raw units, 1e15 tokens), and credits all of it withbalances[msg.sender] = _totalSupply;. The state variableaddress private _owner = 0x4C31d7FE36f20cd848f52C57B53cB697C2d282D5;is hard-coded to the deployer address. transferonly subtracts from the sender and adds to the recipient, with no condition and no fee, so tokens can leave a pool to a buyer and move between wallets.transferFrombegins withrequire(from == _owner, "You are not the owner!");. A holder who sells through a router approves it and the router callstransferFrom(holder, pool, amount); withfromequal to the holder, therequirereverts.- The source never assigns
_ownerafter deployment (it isprivate, with no setter), so the check cannot be relaxed. Only a call whosefromis the deployer address can pass it. - What the code allows: buyers can acquire and hold the token, and the deployer address alone can sell through the router path. What is documented as having happened: De.Fi's REKT database lists the token as an Exit Scam/Honeypot; no opened transaction shows a specific sale, liquidity removal or loss amount.
Protocol details
Evidence
- report Sourcify repository entry for the same contract (source, compiler 0.5.16, deployer and deploy block time) repo.sourcify.dev
- address BscScan verified source, AurataGoldCat 0x286920ac02e60a84dfbb6f40929a49f261e5b9cb bscscan.com
- analysis De.Fi REKT database listing for AUGC (fields supplied in meta.json; the Token Sniffer proof link returned HTTP 403) tokensniffer.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
