What happened
Humble (HUMB) is a BEP-20 token deployed on BNB Chain on 27 March 2021 at 0xf358fdba…5f29cd by 0xB2b50Aa6…74fB51. Its header comment presents it as a yield farm and says the mint function is inaccessible, but the deployed contract has no farm logic. Every transfer runs a check, ensure, that passes only when the sender or recipient is the owner, the sender is an owner-chosen tradeAddress, or the sender is on an owner-managed canSale list.
Everyone else falls through to condition, which always returns false because its three limits are never set, so if the owner points tradeAddress at the PancakeSwap pair, buyers can receive HUMB but cannot sell it. The owner can also overwrite any address's balance through a function misleadingly named approveAndCall. De.Fi's REKT database lists Humble as an exit scam/honeypot dated 27 March 2021, with no loss figure.
How it happened
- The constructor sets the private
ownerto the deployer and gives it the whole supply of 30,000 HUMB. There is no function that changesowner; the function namedtransferownershiponly setstradeAddress. transferandtransferFromboth callensure, which returns true onlyif(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]). Otherwise it runsrequire(condition(_from, _value)).conditionstarts withif(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The three private variables have no setter, so they stay zero and every transfer from an ordinary holder reverts, whatever the amount.- Transfers out of
tradeAddresspass. With the pair set astradeAddress, the pool can send tokens to buyers, while a sale, which is a transfer from the buyer to the pair, fails. approveAndCall(address spender, uint256 addedValue)is owner-only: it setsbalanceOf[spender] = addedValue*(10**uint256(decimals))and adds the address tocanSale. This works as a hidden mint: the owner can give any address an arbitrary balance, outsidetotalSupplyand with noTransferevent, and let it sell into the pool, or overwrite a holder's balance with a smaller amount.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
