What happened
Constellation (CONST) is a BEP-20 token on BNB Chain built from the standard BEP20Token template with a modified _approve function. That function stores the requested allowance only when the approving address is the hard-coded deployer wallet 0x8f1A18e7…12968D; for every other holder it writes an allowance of 0. Selling on PancakeSwap requires the router to pull tokens with transferFrom, which then fails because the holder's allowance is always zero, so holders can buy but cannot sell back to BNB.
The owner can also mint new tokens through mint. De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction evidence of losses was found.
How it happened
- The constructor mints the full supply of
8723563500000000000raw units (7 decimals) to the deployer. - Buying works: the PancakeSwap pair sends tokens to the buyer with a plain
transfer, which has no extra checks. - To sell, a holder first calls
approvefor the router, but_approverecords the allowance only whenowner == address(0x8f1A18e72101B185FBFC866A59965dF44c12968D); for anyone else it sets_allowances[owner][spender] = 0. - The router's
transferFrommoves the balance and then subtractsamountfrom that zero allowance, which reverts withBEP20: transfer amount exceeds allowance, undoing the sale. - The deployer wallet keeps a working allowance and can sell into the pool, and as owner can create more tokens with
mint. Because the exemption is a hard-coded address, notowner(), renouncing ownership would not remove it.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
