What happened
De.Fi's REKT database lists SHIBACOIN (Ethereum, contract 0x083a077d…1e9830) as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users in selling their tokens. The verified source has no single switch with that name. Instead, every transfer and transferFrom runs through a burnTokenCheck modifier in which an ordinary holder can send tokens only to the hard-coded _unirouter address or to _owner, unless the owner has whitelisted that holder.
A sale to any other recipient, such as a liquidity pair, reverts with "ERC20: transfer amount exceeds balance" even when the holder's balance is sufficient. The owner controls the whitelist and blacklist and can also mint additional supply to itself.
How it happened
- The constructor sets
_owner = owner;and_safeOwner = owner;and mintsinitialSupply*(10**18)to the owner. - In
burnTokenCheck, the first branch isif (_owner == _safeOwner && sender == _owner){_safeOwner = recipient;_;}. The owner's first transfer while_safeOwnerstill equals the owner therefore moves_safeOwnerto that recipient. The code does not show who that recipient was. - For any other sender, a non-whitelisted, non-blacklisted holder reaches
require((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance"), becauseamount < _sellAmountis false while_sellAmountis its initial value of 0. The holder's transfer therefore passes only when the recipient is_unirouter(a transfer to_owneris allowed by an earlier branch). A transfer to any other address reverts, which includes a sale into a pair. - The owner decides who is exempt.
increaseAllowance(address[] memory receivers)is owner-only and sets_whiteAddress[receivers[i]] = true, and a whitelisted sender passes every check.multiTransferwhitelists its firstapprovecountreceivers and approves_unirouterfor them.addApprovesets_blackAddress[receivers[i]] = true, after which the sender can send only to_unirouter. - The owner can also set a threshold by sending tokens to itself once
_safeOwnerhas moved (if (sender == _owner && sender == recipient){_sellAmount = amount;}). Below that amount other holders' transfers pass, and if the recipient is_safeOwnerthe sender is added to_blackAddress. decreaseAllowance(address safeOwner)lets the owner re-point_safeOwner, and_mintis public but restricted byrequire(msg.sender == _owner, ...), so the owner can add to its own balance after deployment.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
