What happened
MHP88 (symbol 888) is a BNB Chain token deployed on 16 March 2021 at 0xa8d34eac…47ea79 with a total supply of 888 tokens, all credited to the deployer. Its transferFrom only works when the sender is on an allow list, and the constructor puts only the deployer on it. A PancakeSwap sale moves the seller's tokens with transferFrom, so every holder not on the list cannot sell through the router, while buys, which the pair pays out with transfer, go through.
The list and a mint function that overwrites any balance are controlled by an address hard-coded into onlyOwner as a decimal number, 0xbd486897…439192, not by the visible owner variable. De.Fi's REKT database lists MHP88 as an exit scam/honeypot.
How it happened
- The constructor sets
balances[msg.sender] = totalSupplyandallow[msg.sender] = true, so the deployer 0x450943a0…d006A7 holds the 888-token supply and is the only address on theallowlist. transferFromcontainsrequire(allow[_from] == true);. Adding liquidity through the router is atransferFromfrom the deployer, which passes.- Buyers receive tokens from the pair through
transfer, which has noallowcheck, so buys succeed. - A router sale calls
transferFromwith the holder as_from. The holder is not on the list, so the call reverts and the sale fails. addAllow(address holder, bool allowApprove)andmint(address miner, uint256 _value)are gated byonlyOwner, which checksmsg.sender == address(1080614020421183795110940285280029773222128095634), the hard-coded address 0xbd486897…439192. That address can add or remove sellers and set any address's balance to any value without changingtotalSupply.transferOwnershiponly rewrites theownervariable, whichonlyOwnernever reads, and there is norenounceOwnership, so the hard-coded controller cannot be changed or removed.
Protocol details
Evidence
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
