What happened
Finance (ARKEN) is a BNB Chain token deployed on 25 March 2023 at 0x636cc5d8…CbCE25 by 0x8Db85c73…C85661 and paired with USDT on PancakeSwap. Its transfer logic lets anyone buy from the pair, but a sale or wallet-to-wallet transfer by an ordinary holder reverts with "canSell" unless the flag canSell is on, and canSell starts off and can be flipped only by _tokenOwner, an address fixed at deployment. The same address can put a per-wallet sell cap on any holder with maxSellToken, and it is the only address allowed to add liquidity to the pair. Fee-exempt addresses (the tokenOwner argument, the deployer and the contract) skip the canSell check, the sell cap and the fee, but not the add-liquidity check; only the contract itself and any extra pair the owner registers with addOtherTokenPair bypass every rule. Because these powers hang on _tokenOwner rather than owner, the fact that owner now reads as the dead address does not remove them.
On 27 March 2023 CertiK reported that the deployer removed about $81k from the liquidity pool and that the token also appeared to be a honeypot. De.Fi's REKT database adds that the deployer sold a large amount of tokens and the price fell about 90%, and gives 0x4b251122…a1903f as an example liquidity-removal transaction.
How it happened
- The constructor mints 100,000,000 ARKEN to the
tokenOwnerargument, creates an ARKEN/USDT pair, and exemptstokenOwner, the deployer and the contract from fees. - For non-exempt addresses,
_transfertreats a transfer to the pair as a sale and any non-pair transfer the same way, and both branches runrequire(canSell,"canSell").canSellis a plain boolean that starts false. changeCanSell()checks onlyrequire(_tokenOwner == msg.sender)and flips the flag, so that one address decides whether holders can sell and can close selling again at any time.maxSellToken(userAddress, tokens)lets the same address set a cumulative sell limit per wallet, enforced withrequire(_maxSell[from] >= _haveSell[from].add(amount), "maxSell"), so a tiny limit freezes a chosen holder even while selling is open.- Buys from the pair skip these checks and pay a 5% fee sent to the dead address, so money can keep flowing into the pool while holders cannot get out.
- CertiK reported that the deployer then removed about $81k from the pool, which is the USDT side holders would have sold into.
Protocol details
Evidence
- report @CertiKAlert incident report twitter.com
- report CertiK Alert: large liquidity removal on Finance (ARKEN), 27 March 2023 twitter.com
- transaction Finance (ARKEN) contract creation transaction bscscan.com
- transaction De.Fi REKT database entry for ARKEN (write-up with deployer and example transaction) de.fi
- transaction bscscan.com transaction 0x4b25…903f bscscan.com
- address Finance (ARKEN) verified contract code on BscScan bscscan.com
- address bscscan.com address 0x8db8…5661 bscscan.com
- analysis Sourcify match for 0x636cc5d886F928c2E33d0d52b0fcAe0155CbCE25 on BNB Chain repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
