What happened
OnlyFans (OLF) is a BEP-20 token on BNB Chain whose transfer logic blocks ordinary holders from selling by default. Every transfer and transferFrom passes through the burnTokenCheck modifier: the owner, the _safeOwner address and owner-whitelisted wallets can move tokens freely, while any other sender is rejected unless the recipient is the hard-coded PancakeSwap router address. A PancakeSwap sale sends tokens to the pair, not the router, so it reverts with a fake ERC20: transfer amount exceeds balance error.
The owner also controls whitelist and blacklist setters disguised as increaseAllowance and addApprove, and a public _mint that lets the owner create unlimited tokens. De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction evidence of losses was found.
How it happened
- The constructor sets both
_ownerand_safeOwnerto the deployer-supplied owner and mints the supply to it. - The first transfer the owner makes while
_owner == _safeOwnerreassigns_safeOwner = recipient, giving that recipient unrestricted sending rights. _sellAmountstarts at0, so for a holder who is neither whitelisted nor blacklisted the checkamount < _sellAmountis false and the transfer only succeeds ifsender == _safeOwnerorrecipient == _unirouter.- Selling through PancakeSwap moves the holder's tokens to the pair contract, so neither condition holds and the sale reverts with a message that imitates an insufficient balance.
- The owner can open a narrow window by transferring to itself, which sets
_sellAmount; a holder who then sends a smaller amount to_safeOwneris automatically moved onto the blacklist. - Separately, the owner can whitelist or blacklist any address and mint any amount to itself through the public
_mintfunction.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
