What happened
This DeFiner (DEFI) token on BNB Chain, contract 0xc4a70aa0…c9593a, has a sell fee that only the owner can switch on and that is not capped. When _feeEnabled is true, a transfer to the Pancake pair created in the constructor takes mul(div(amount, 100), 100) as the fee, which is the whole amount except a remainder below 100 base units, and that fee is destroyed from _totalSupply. The owner, the router address and the contract itself are exempt.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot and states that the contract owner could disable the transfer function, which restricted users in selling their tokens.
How it happened
- The constructor gives the whole supply to the deployer and creates the pair:
_balances[_owner] = _totalSupply;anduniswapV2Pair = IUniswapV2Factory(uniswapV2Router.factory()).createPair(address(this), uniswapV2Router.WETH());. The fee flag starts off:bool public _feeEnabled = false;. - Only the owner can turn it on or off:
function setFeeEnabled(bool feeEnabled) external { require(_owner == msg.sender); _feeEnabled = feeEnabled; }. There is no limit on its use and no function to give up ownership. - In
_transferthe sender is always debited the full amount (_balances[from] = sub(_balances[from], amount);). If_feeEnabled && to == uniswapV2Pair && from != address(uniswapV2Router) && from != _owner && from != address(this), the fee ismul(div(amount, 100), 100), i.e. the amount rounded down to a multiple of 100 base units. - The pair is credited only
sub(amount, fee), the leftover below 100 base units (under 0.0000001 token with 9 decimals), and the fee is removed with_totalSupply = sub(_totalSupply, fee);rather than credited to anyone. A holder selling into the pair therefore gives up essentially the whole amount while the owner, being exempt, is not affected. - Transfers to any address other than the pair, and all transfers while the flag is false, take the plain branch
_balances[to] = add(_balances[to], amount);.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
