What happened
Karma (KARMA) was a BNB Chain token whose internal _approve function only stores an allowance when the approving wallet is one hard-coded address, the deployer 0x583cE930…2c4cE1. For every other holder, approve succeeds and emits an Approval event, but the stored allowance is always set to 0. Selling through the PancakeSwap router needs the router to pull tokens with transferFrom, which then reverts on the zero allowance, so ordinary holders could buy but not sell through the router while the deployer could.
The owner can also mint unlimited new tokens. De.Fi's REKT database lists Karma as an exit scam / honeypot dated 2021-04-12.
How it happened
- The deployer receives the full 50,000,000 KARMA supply at deployment (
_totalSupply = 5000000000;with_decimals = 2;). - Every allowance write goes through
_approve, which checksif (owner == address(0x583cE930fC4cB32D00B39B4B1Baa823A462c4cE1)). Only that wallet's approvals are stored; for anyone else theelsebranch runs_allowances[owner][spender] = 0;. - Because the deployer's approvals work, it can approve the router and add liquidity normally. Buyers receive tokens from the pair through plain
transfer, which has no such check. - When a holder tries to sell, the router calls
transferFrom, which moves the balance and then recomputes the allowance with.sub(amount, "BEP20: transfer amount exceeds allowance"). The allowance is 0, so the whole sell reverts. - The check is on a hard-coded address, not on
owner(), sorenounceOwnershipwould not lift it. Renouncing would only disable the owner'smint(uint256 amount) public onlyOwnerfunction, which otherwise lets the owner create unlimited KARMA.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
