What happened
BSCSportsBet (Betcoins, 9 decimals) limits transferFrom to one hard-coded address: require(from == _owner, "You are not the owner!");. A decentralized-exchange sale moves the seller's tokens through transferFrom, so for every holder other than that address the call reverts, while transfer carries no check and a pool paying out a purchase or a wallet-to-wallet send is not affected. The address in _owner is the deployer, 0x60A23316…5Fd03f, and the source contains no function that changes _owner or lifts the check, so the restriction is fixed from deployment rather than switched on later.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot and describes it as: the contract owner could disable the transfer function, which restricted users in selling their tokens. The listing dates the incident 2021-06-14 and gives no loss figure.
How it happened
- The constructor sets
name = "BSCSportsBet",symbol = "Betcoins",decimals = 9and_totalSupply = 100000000000000000000(1e20 raw units, 100 billion tokens), and credits all of it withbalances[msg.sender] = _totalSupply;. The state variableaddress private _owner = 0x60A2331633dd44ce845031d1E3e17d964A5Fd03f;is hard-coded to the deployer address. transferonly subtracts from the sender and adds to the recipient, with no condition, so tokens can be sent out of a pool to a buyer and between wallets.transferFrombegins withrequire(from == _owner, "You are not the owner!");. A holder who sells through a router approves it and the router callstransferFrom(holder, pool, amount); withfromequal to the holder, therequirereverts.- No function in the source assigns
_ownerafter deployment, and the variable isprivatewith no setter, so the check cannot be relaxed. Only transfers whosefromis the deployer address can pass it. - What the code allows: buyers can acquire and hold the token, and the deployer address alone can sell through the router path. What is documented as having happened: De.Fi's REKT database lists the token as an Exit Scam/Honeypot; no opened transaction shows a specific sale, liquidity removal or loss amount.
Protocol details
Evidence
- report Sourcify repository entry for the same contract (source, compiler 0.5.16, deployer and deploy block time) repo.sourcify.dev
- address BscScan verified source, BSCSportsBet 0xabd742c6f41d122f5d28f9ecb6590ef65b662445 bscscan.com
- analysis De.Fi REKT database listing for Betcoins (fields supplied in meta.json; the Token Sniffer proof link returned HTTP 403) tokensniffer.com
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
