What happened
This Ethereum token, named Findora (FRA), blocks ordinary holders from selling by default. Every transfer and transferFrom passes through the burnTokenCheck modifier. The owner, the _safeOwner address and owner-whitelisted wallets can send freely, and any holder can send to the owner.
While _sellAmount keeps its starting value of 0, every other transfer from an ordinary holder is rejected unless the recipient is the hard-coded Uniswap V2 router address. A Uniswap sale sends tokens to the pair, not the router or the owner, so it reverts with a fake ERC20: transfer amount exceeds balance error. The owner controls whitelist and blacklist setters disguised as increaseAllowance and addApprove, can reassign _safeOwner through decreaseAllowance, and can mint unlimited tokens through a public _mint.
De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction evidence of losses was found.
How it happened
- The constructor sets both
_ownerand_safeOwnerto the owner address passed at deployment and mints the supply to it. - The first transfer the owner makes while
_owner == _safeOwnerreassigns_safeOwner = recipient, giving that recipient unrestricted sending rights; the owner can also set it directly withdecreaseAllowance. - The check
if (sender == _owner || sender == _safeOwner || recipient == _owner)lets any transfer to the owner through. For other transfers from a holder who is neither whitelisted nor blacklisted,_sellAmountstarts at0, soamount < _sellAmountis false and the code falls torequire((sender == _safeOwner)||(recipient == _unirouter), ...). That tests the sender, which cannot be_safeOwnerat this point, so the transfer succeeds only if the recipient is the router. - Selling through Uniswap moves the holder's tokens to the pair contract, which is neither the owner nor the router, so the sale reverts with a message that imitates an insufficient balance.
- The owner can raise
_sellAmountby transferring to itself. A holder's transfer below that amount then goes to any recipient, but one sent to_safeOwneralso puts the sender on the blacklist, after which it can send only to the owner or the router. - Separately, the owner can whitelist wallets (including through
multiTransfer, which also pre-approves the router for them), blacklist any address, and mint any amount to itself.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
