What happened
This BNB Chain token (BondAppetit, BOND, 100000000 tokens with 9 decimals) contains an owner-switchable sell tax that takes effectively the whole amount. When the owner turns _feeEnabled on, a transfer to the pair address from any sender other than the router, the owner or the contract debits the sender in full but credits the pair with only the remainder left after a fee computed as mul(div(amount, 100), 100). De.Fi's REKT database lists the token as an exit scam/honeypot on 2021-05-03 and states that the owner could disable the transfer function so users could not sell; no loss amount is listed.
How it happened
- The constructor creates a pair for the token against
WETHthrough the hard-coded router address0x10ED43C718714eb63d5aA57B78B54704E256024E(the code comment says Pancakeswap) and stores it in the immutableuniswapV2Pair._feeEnabledstarts asfalse, so early transfers carry no fee. - Only the owner can change the flag:
function setFeeEnabled(bool feeEnabled) external { require(_owner == msg.sender); _feeEnabled = feeEnabled; }. The source has no function that transfers or renounces_owner. - In
_transfer, the sender is always debited first:_balances[from] = sub(_balances[from], amount);. - With
_feeEnabledtrue, a transfer withto == uniswapV2Pairfrom a sender that is not the router,_owneror the contract takes the fee branch:uint256 fee = mul(div(amount, 100), 100);. Dividing by 100 and multiplying by 100 returns the amount rounded down to a multiple of 100 base units, so the fee equals the amount except for a remainder of 0 to 99 base units (at most 0.000000099 tokens). - The pair is credited only
sub(amount, fee)(_balances[to] = add(_balances[to], sub(amount, fee))), and_totalSupply = sub(_totalSupply, fee)reduces the supply by the difference. A holder who sells into the pair therefore loses the tokens sold and the pool receives close to nothing, while the owner and the router are exempt from the branch. - The code allows this only after the owner enables the flag; no transaction was opened showing it being switched on, and the amount lost is not stated by any opened source.
Protocol details
Security review history
- MixBytes View report
- HashEx View report
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
