What happened
BitLink (BITLINK) is a BNB Smart Chain token whose verified source lets the owner switch on a sell penalty that takes almost the whole amount of any sale into the liquidity pair. The fee is off at deployment, but setFeeEnabled is owner-only, has no cap and can be flipped at any time, while the owner, the router and the token contract are exempt. De.Fi's REKT database lists the token as an exit scam/honeypot dated 2021-04-26 and says the contract owner could disable the transfer function, which restricted users in selling their tokens; the verified code contains no function that disables transfers, and the sell restriction it does contain is this fee switch.
How it happened
- The constructor sets
_owner = msg.senderand_balances[_owner] = _totalSupply;, so the deployer holds the whole supply (100000000 * 10**9, 9 decimals). It also creates the pair with.createPair(address(this), uniswapV2Router.WETH())on the router at 0x10ED43C7…56024E. bool public _feeEnabled = false;means ordinary transfers and sells work at first. Only the owner can change it:function setFeeEnabled(bool feeEnabled) external { require(_owner == msg.sender); _feeEnabled = feeEnabled; }.- Once enabled,
_transferapplies the fee to any transfer whereto == uniswapV2Pairandfromis not the router, the owner or the token contract. A holder selling through the router is thefromaddress intransferFrom, so the holder is the one penalised. - The fee is
uint256 fee = mul(div(amount, 100), 100);, which isamountrounded down to a multiple of 100, so the fee equals the whole amount except the remainder (at most 99 base units). The seller is debited the full amount first (_balances[from] = sub(_balances[from], amount);), the pair is credited onlysub(amount, fee), and the fee is subtracted from_totalSupplyinstead of being paid to anyone. - Buys (
fromis the pair) and any transfer by the owner skip this branch, so the owner can sell while holders cannot. - The owner can switch the fee off again with the same function. The contract has no ownership-transfer or renounce function, and
_owneris only assigned in the constructor.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
