What happened
Ergosphere (ERGO) is a BNB Chain token deployed on 22 April 2021 at 0x8d06a972…841701 by 0x098bEF83…D1b487. Its _approve function stores a real allowance only when the approving account is that hard-coded deployer address; for every other holder it writes an allowance of 0 while emitting an Approval event with the value 4. Selling through the PancakeSwap router needs transferFrom, which subtracts the sale amount from that zero allowance and reverts, so holders can buy but cannot sell through the router.
The exemption is tied to the hard-coded address, not to owner, so renounceOwnership would not lift it; the owner can also mint unlimited new tokens with mint. De.Fi's REKT database lists the token as an exit scam/honeypot.
How it happened
- The constructor mints the full supply, 29,979,245,800 ERGO (
29979245800000000at 6 decimals), to the deployer. _approverunsif (owner == address(0x098bEF838d5683210e0d569Fb371631ca7D1b487))and stores the requested amount only for that address. Every other caller gets_allowances[owner][spender] = 0;followed byemit Approval(owner, spender, 4);, so a wallet sees an approval event while nothing is approved.- The deployer's own allowance works, so the router can pull the deployer's tokens with
transferFromto add liquidity. Buys also work, because the pair pays tokens out with plaintransfer, which has no restriction. - A holder's sale through the router calls
transferFrom(holder, pair, amount). After_transfermoves the tokens, the function computes_allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")on a zero allowance, which reverts and undoes the whole sale. - This token's code does not touch the pool's LP tokens, so whoever holds them can remove the liquidity, including buyers' BNB, at any time. The blog post De.Fi cites describes this template's exit as removing liquidity after buyers have added BNB.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- report Token Sniffer post 1380219360631906307 (seed link) twitter.com
- transaction Ergosphere contract creation transaction bscscan.com
- address Ergosphere (ERGO) verified contract code on BscScan bscscan.com
- analysis Sourcify match for 0x8d06a972a88b49f4bedb420b08a527c287841701 on BNB Chain repo.sourcify.dev
- analysis BSC-SCAM: PancakeSwap NoApproval (cryptot3ddybear, 8 April 2021) cryptot3ddybear.gitlab.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
