What happened
OBB was a BNB Chain token traded against a liquidity pool. Its transfer function lets an address move tokens only if it is a contract, has a transfer allowance granted by the admin, or is trading with the address stored as _usdtPair; every other transfer reverts with "Block is busy, please try again". Because the pool itself is a contract, buys always pass, while ordinary holders' sells work only while _usdtPair points at the real pool.
That address is empty at deployment and the admin can set or change it at any time. The admin can also set an uncapped burn of up to 100% of every amount received. CertiK reported on April 2, 2023 that OBB had dropped about 91% after the deployer 0x7F0a80d6…9f0240 removed liquidity in six transactions over two days, profiting about $96,000.
How it happened
- The deployer receives the full supply and
DEFAULT_ADMIN_ROLEin the constructor:CZERC20(_name, _symbol,_totalSupply,_msgSender())and_grantRole(DEFAULT_ADMIN_ROLE, _msgSender());. - Every transfer not sent to the burn address passes through this gate:
if(number>0 && number>=amount){ ... }else if(isTxt(from)){ }else if(from==_usdtPair||to==_usdtPair){ } else{ require(false,"Block is busy, please try again"); }. - A buy moves tokens out of the pool, which is a contract, so
isTxt(from)lets it through regardless of settings. A holder's sell moves tokens from an EOA to the pool, so it passes only ifto==_usdtPair. _usdtPairhas no initial value, so it starts as the zero address, and the admin controls it withsetUsdtPair(address Pair_) public onlyRole(DEFAULT_ADMIN_ROLE){ _usdtPair=Pair_; }. While it is unset or points anywhere other than the real pool, every EOA sell reverts while buys continue.setBotHMDArr(address user,uint256 amount)grants chosen addresses an allowance to move tokens past the gate.setBackscale(uint256 scale_)sets_scalewith no cap, and each transfer then sendstAmount.div(100).mul(_scale)from the recipient to the burn address, so the admin can burn up to 100% of what a buyer receives.- CertiK reported that between about March 31 and April 2, 2023 the deployer removed liquidity in six transactions, profiting about $96,000, and the price fell about 91%. De.Fi's listing also says the deployer sold a large quantity of tokens and gives 0x46cf7422…4703cd as an example sale transaction.
Protocol details
Evidence
- report @CertiKAlert incident report twitter.com
- report CertiK Alert post on OBB (OBB) price slippage twitter.com
- transaction bscscan.com transaction 0x46cf…03cd bscscan.com
- address OBB verified contract source, BscScan bscscan.com
- address bscscan.com address 0x7f0a…0240 bscscan.com
- analysis Sourcify exact match for 0xc7654DB2271194632E70310F8ADc925D12Bf5246 (chain 56) repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
