What happened
LamboToken (LAMBO) is a BNB Smart Chain token whose transferFrom function only works for holders that the deployer has switched on in an allow mapping. Only the deployer is switched on in the constructor, so any move that a spender pulls out of an ordinary holder's balance, which is what a DEX router does when a holder sells, reverts. De.Fi's REKT database lists LAMBO as an exit scam / honeypot in which the contract owner could disable the transfer function and restrict users from selling their tokens.
How it happened
- The constructor credits the whole supply to the deployer and marks only that address as allowed:
balances[msg.sender] = totalSupply;andallow[msg.sender] = true;. transferhas noallowcheck, so a holder can still send tokens directly:require(balances[msg.sender] >= _value);.transferFrom, the function a router calls after a holder approves it, adds one extra condition:require(allow[_from] == true);. For any holder whoseallowentry is false, the call reverts even thoughapprovesucceeded and the balance and allowance are sufficient.- The deployer's address is hard-coded in the modifier
onlyOwner() {require(msg.sender == address(0x877733bbfCe6A04c32FE2C3F2AC63bE8B6B046B7));_;}and can calladdAllow(address holder, bool allowApprove)to set the flag to true or false for any holder, so it can allow chosen holders to sell and block everyone else. transferOwnershiponly rewrites theownervariable, whichonlyOwnernever reads, so the hard-coded address keeps this power, and the code has no function that removes it.
The code allows this; the sources opened for this entry do not show on-chain transactions of the deployer calling addAllow or any individual holder's failed sale.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
