What happened
Coffee Shop DAO (COF) is an Ethereum token whose transferFrom runs every sender through an ensure check. Senders other than the owner, the owner's chosen tradeAddress and addresses the owner marks in canSale must also pass condition, which returns false while three limit variables are all zero. Nothing in the contract ever writes those variables, so ordinary holders' transfers revert, including sells.
The owner can exempt addresses, such as a trading pair, by calling transferownership or approveAndCall. De.Fi's REKT database lists COF as an Exit Scam/Honeypot dated 2021-05-27, stating the contract owner could disable the transfer function, which restricted users in selling their tokens, and links Source. No loss figure is given.
How it happened
- The constructor assigns the whole supply to the deployer:
owner = msg.sender; balanceOf[msg.sender] = totalSupply;. transferFrom(also used bytransfer) callsrequire(ensure(_from, _to, _value));before moving balances.ensurelets four cases through:if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]){ return true; }. Everyone else must satisfyrequire(condition(_from, _value));.conditionbeginsif(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The variables_saleNum,_minSaleand_maxSaleare declaredprivateand the source has no assignment to them, so a holder who is not on the exempt list always hits this line and the transfer reverts. A sell into a pair is such a transfer.- The owner alone controls the exemptions:
transferownership(addr)setstradeAddress, andapproveAndCall(spender, addedValue)setscanSale[spender]=true. Whether the owner exempted a pair or any other address was not checked in an opened transaction. approveAndCallalso executesbalanceOf[spender] = addedValue*(10**uint256(decimals));, which overwrites a balance without changingtotalSupply; the code allows this, and no transaction shows it being used. Transfers to the owner address are always allowed (_to == owner).
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
