What happened
Cassiopeia (CASS) is a BEP-20 token on BNB Chain whose _approve function only records an allowance when the approving address is the hard-coded deployer 0xD24Ca0a7…86A54d; for every other holder it stores an allowance of 0. Buying works because the pool sends tokens with transfer, but a standard PancakeSwap sale needs the router to pull tokens with transferFrom, which then fails the allowance check and reverts. This block is written into the code rather than switched on later, so it applies from deployment and cannot be turned off, even by transferring ownership.
The owner can also mint unlimited tokens to itself. De.Fi's REKT database lists the token as an exit scam/honeypot.
How it happened
- The constructor credits the whole supply of 2,348,735,000
CASS(3 decimals) to the deployer. - Buyers receive tokens from the PancakeSwap pair through
transfer, which only checks balances. - To sell, a holder calls
approvefor the router, but_approverunsif (owner == address(0xD24Ca0a721Ed037C8a38609362f064B5c886A54d)) { _allowances[owner][spender] = amount; ... } else { _allowances[owner][spender] = 0; emit Approval(owner, spender, 0); }, so the stored allowance stays zero.increaseAllowancegoes through the same function. - The router's
transferFromthen runs_allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"), which reverts for any non-zero amount, so the sale fails. - Only the hard-coded deployer address can approve the router and sell. Separately,
mint(uint256 amount)lets the owner add any amount to its own balance.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
