What happened
EASYPump (EPUMP) restricts selling through a whitelist on transferFrom. The constructor sets allow[msg.sender] = true for the deployer only, and transferFrom begins with require(allow[_from] == true) among its checks, so any other holder whose tokens are pulled by a contract such as the Uniswap V2 router reverts, while plain transfer calls are unrestricted. Only the owner can add addresses through addAllow. On 2021-01-11 the deployer sent 600 EPUMP to 12 addresses through a multisend contract, added 11 ETH and 100,000 EPUMP to Uniswap V2 at 09:57 UTC, and at 10:10 UTC removed liquidity, receiving 13.50 ETH and 81,560.81 EPUMP. De.Fi's REKT database lists the token as an exit scam/honeypot with a loss of 2,720 USD.
The contract deployer airdropped tokens to some external wallets before adding liquidity at: Tx 0x8434…568c
The contract deployer added initial liquidity at: Tx 0xbbe2…bade
The liquidity was removed by the contract deployer at: Tx 0xd3dd…a687
How it happened
- The constructor gives the whole supply to the deployer and whitelists only that address:
balances[msg.sender] = totalSupply; allow[msg.sender] = true;. transferFromcarries a sender whitelist check:require(allow[_from] == true);.allowdefaults to false for every other address, andfunction addAllow(address holder, bool allowApprove) external onlyOwner { allow[holder] = allowApprove; }is the only way to change it.- A Uniswap V2 router sell pulls the seller's tokens with
transferFrom(seller, pair, amount), so for a seller withallow[seller] == falseit reverts.transferhas no such check (function transfer(address _to, uint256 _value)only tests balance and the zero address), so buys from the pair and direct wallet transfers are not blocked by this code. No transaction was opened showing a holder's sell reverting or the owner callingaddAllow. - On 2021-01-11 the deployer address 0xf92eE989…871450 sent 600 EPUMP to 12 recipient addresses (50 each) through a multisend contract (0x8434567b…fd568c), then called
addLiquidityETHwith 11 ETH and 100,000 EPUMP and received 1,048.8088 LP tokens (0xbbe2f8bf…08bade). - About 13 minutes later the same address called
removeLiquidityETHWithPermit, burning 1,048.81 LP tokens for 13.50 ETH and 81,560.81 EPUMP (0xd3dde280…bfa687).
Protocol details
Evidence
- report De.Fi REKT database listing for EPUMP (listing data supplied with the input) twitter.com
- transaction Etherscan transaction 0x8434567b...ccd568c (multisendToken) etherscan.io
- transaction Etherscan transaction 0xbbe2f8bf...4508bade (addLiquidityETH) etherscan.io
- transaction Etherscan transaction 0xd3dde280...bfa687 (removeLiquidityETHWithPermit) etherscan.io
- address Etherscan verified source, EASYPumpToken 0xa434cd109542267279bb761271f793e3701441f9 etherscan.io
- analysis Sourcify repository, EASYPumpToken repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
