What happened
E=MCv2 is a BNB Chain token deployed on 21 March 2021 at 0x536f6240…850bfb. Its transfer function has no restriction, so buys out of a PancakeSwap pool arrive normally, but transferFrom requires allow[_from] == true, and the constructor sets that flag only for the deployer. PancakeSwap router sales pull tokens with transferFrom, so for every other holder a normal sale reverts.
The source comment promises to renounce ownership, but onlyOwner checks a hard-coded address, 0xbd486897…439192, not the stored owner, so moving owner would not remove its power to edit the allowlist with addAllow or overwrite any balance with mint. De.Fi's REKT database lists E=MCv2 as an exit scam/honeypot.
How it happened
- The constructor credits the whole supply to the deployer and sets
allow[msg.sender] = true;for that address only. transferchecks only the destination and the sender's balance, so the pool can send bought tokens to any buyer.- A sale through the router moves tokens with
transferFrom(holder, pair, amount), which runsrequire(allow[_from] == true);. Ordinary holders are not on the list, so the call reverts even with a valid approval. onlyOwnercomparesmsg.senderto a hard-coded address (decimal 1080614020421183795110940285280029773222128095634, 0xbd486897…439192). That address can calladdAllow(holder, bool)to let chosen wallets sell andmint(miner, _value), which setsbalances[miner] = _valuewithout changingtotalSupply.transferOwnershiponly rewrites the unusedownervariable, so handing ownership to a burn address, as the comment promises, would leave both powers with the hard-coded address.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
