What happened
GODZILLA (GZ) is a BEP-20 token on BNB Chain at 0x241e33bf…27bb59, deployed on 9 April 2021 by 0xe660a706…34B593 with a 100,000,000 GZ supply credited to that address. De.Fi's REKT database lists it as an exit scam/honeypot. The verified source does not switch transfer off; instead transferFrom requires the sender to be on an allow list, and at deployment only the deployer is on it.
DEX sales run through transferFrom, so every holder other than the deployer is blocked from selling through the router. The admin functions are guarded by a hard-coded address, 0xbd486897…439192, written as a decimal number, which can add wallets to the list or set any wallet's balance to any value with mint.
How it happened
- The constructor credits the whole supply to the deployer and allowlists only it:
balances[msg.sender] = totalSupply;andallow[msg.sender] = true;. - Buyers receive GZ from the PancakeSwap pair through
transfer, which checks only the recipient and balance, so buys succeed. - To sell, the router calls
transferFrom, which includesrequire(allow[_from] == true);. A buyer is not on the list, so the sale reverts. onlyOwnerignores the storedownerand instead checksmsg.sender == address(1080614020421183795110940285280029773222128095634), a decimal form of 0xbd486897…439192. That address alone can calladdAllow(holder, allowApprove)to let chosen wallets sell.- The same address can call
mint(miner, _value), which setsbalances[miner] = _value;for any wallet without changingtotalSupply, so it can create tokens for itself or wipe a holder's balance.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
