What happened
Enlighten (LIGHT) is a 100 million supply token on BNB Smart Chain with an owner-only switch, setFeeEnabled, that is off by default. Once the owner turns it on, any sale into the token's PancakeSwap pair by a holder other than the router, owner or the contract itself is charged a fee computed as the whole amount rounded down to a multiple of 100 base units, so the pair is credited at most 99 base units while the seller's full amount is debited. De.Fi's REKT database lists LIGHT as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users from selling their tokens.
How it happened
- The constructor gives the entire supply to the deployer and creates the pair:
_balances[_owner] = _totalSupply;and.createPair(address(this), uniswapV2Router.WETH());._feeEnabledstarts asfalse. - Only the owner can flip the switch:
function setFeeEnabled(bool feeEnabled) external { require(_owner == msg.sender); _feeEnabled = feeEnabled; }. The source has no function to change_owneror to renounce it. - With the switch on,
_transferfirst debits the sender in full (_balances[from] = sub(_balances[from], amount);) and then, whento == uniswapV2Pairand the sender is not the router,_owneror the contract, computesuint256 fee = mul(div(amount, 100), 100);. That equalsamountminusamount % 100. - The pair is credited only
sub(amount, fee), which isamount % 100, and the fee is removed from supply rather than paid to anyone:_totalSupply = sub(_totalSupply, fee);. A sale of fewer than 100 base units pays no fee, but at 9 decimals that is below 0.0000001 token. - The router,
_ownerand the token contract are exempt from the fee, so the owner's own sells to the pair are not affected. Whether the owner calledsetFeeEnabled(true)is not shown by the source; no transaction was opened.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
