What happened
Librex (LIBREX) is a BEP-20 token on BNB Chain at 0x0fce35b9…45e314, deployed on 30 April 2021 at 19:08 UTC. De.Fi's REKT database lists it as an exit scam/honeypot. The contract creates its own PancakeSwap pair and has a "fee" that the deployer can switch on with setFeeEnabled.
While it is on, any transfer into the pair from a wallet other than the deployer, the router or the contract has mul(div(amount, 100), 100) removed as a fee: the amount rounded down to a multiple of 100 base units, which is essentially the whole sale. Those tokens are deleted from the supply, the pool receives almost nothing, and the seller gets back almost no BNB. The token's current total supply is 17,266.78 LIBREX lower than the 100,000,000 minted, and this fee branch is the only code that lowers it.
How it happened
- The constructor gives all 100,000,000 LIBREX to the deployer and creates the LIBREX/WBNB pair on PancakeSwap, stored in
uniswapV2Pair. setFeeEnabled(bool)can be called only by the deployer (require(_owner == msg.sender)) and sets_feeEnabled. It starts asfalse, so the token trades normally at first.- Buyers purchase LIBREX from the pair. Transfers out of the pair are not covered by the fee condition, so buys arrive in full.
- When
_feeEnabledistrue, a holder's sale sends tokens touniswapV2Pairand meets the conditionto == uniswapV2Pair && from != address(uniswapV2Router) && from != _owner && from != address(this). The contract computesfee = mul(div(amount, 100), 100), credits the pair with onlysub(amount, fee)(fewer than 100 base units, or 0.0000001 LIBREX) and subtracts the fee from_totalSupply. - The seller's tokens are gone and the pool received almost nothing, so the swap pays out almost nothing or fails. The deployer is exempt (
from != _owner) and can still sell at full value.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
