What happened
plex (PLEX) is an Ethereum token deployed on 18 June 2021 at 0x50218697…524192 by 0xEc8f6c95…8f7a89. Its _approve function stores an allowance only when the approving wallet is that hard-coded deployer address; for every other holder it writes an allowance of 0 while emitting an Approval event with a value of 2. Selling through the Uniswap router needs an allowance so the router can pull tokens with transferFrom, so holders can buy and send tokens but a normal sale reverts.
The exemption is tied to the hard-coded address, not to owner(), so moving or renouncing ownership does not remove it. De.Fi's REKT database lists PLEX as an exit scam/honeypot.
How it happened
- The constructor mints the full supply of 1,000,000,000,000 PLEX (9 decimals) to the deployer 0xEc8f6c95…8f7a89.
transferhas no restriction, so tokens bought out of the Uniswap pair arrive normally.- To sell, a holder calls
approvefor the router._approvechecksif (owner == address(0xEc8f6c95Fb0D8865c10b203699761bf2138f7a89)); for anyone else it runs_allowances[owner][spender] = 0;andemit Approval(owner, spender, 2);, so the approval transaction succeeds but grants nothing. - The router's
transferFromthen fails at_allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance"), and the sale reverts. - The hard-coded deployer's approvals are stored normally, so that address can sell into the same pool.
Protocol details
Evidence
- report Token Sniffer post 1380219360631906307 (seed link) twitter.com
- transaction plex contract creation transaction etherscan.io
- address plex (PLEX) verified contract code on Etherscan etherscan.io
- analysis BSC-SCAM: PancakeSwap NoApproval (cryptot3ddybear, 8 April 2021) cryptot3ddybear.gitlab.io
- analysis Sourcify match for 0x502186974059626435a8d544d8226cf7bb524192 on Ethereum repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
