What happened
MechaGodzilla (MGZ) is a BNB Smart Chain token that blocks transferFrom for every address that is not on an owner-controlled allow list. transfer has no such check, but a transferFrom from a holder reverts unless allow[holder] is true, and the only address that can change that flag is one hard-coded in the onlyOwner modifier, not the deployer. De.Fi's REKT database lists the token as an "Exit Scam/Honeypot" dated 2021-09-10 and describes it as the contract owner being able to disable the transfer function, which restricted users in selling their tokens; the listing gives no loss figure, and the proof link, a Token Sniffer X post, could not be opened.
How it happened
- The constructor credits the whole supply to the deployer and marks only the deployer as allowed:
balances[msg.sender] = totalSupply; allow[msg.sender] = true;. Every other address starts withallowfalse. transferhas no allow check, so tokens can still reach a holder's wallet:require(balances[msg.sender] >= _value);is its only condition besides a non-zero recipient.transferFrom, the call a spender such as a DEX router makes to move a holder's approved tokens, addsrequire(allow[_from] == true);. For any holder withallowfalse it reverts, even when the balance and allowance are sufficient.- Only
addAllowflips the flag, andonlyOwneris not tied to theownervariable the constructor sets:modifier onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;}. That decimal literal is the address 0xbd486897…439192, which differs from the deployer 0x9F76CDBC…0f5442. - The same modifier guards
mint(address miner, uint256 _value), which executesbalances[miner] = _value;. It overwrites any address's balance with any value, without changingtotalSupply, so that address can raise or zero any holder's balance.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
