What happened
SmartFinance (SMART) was a BNB Chain token whose transferFrom function only works for addresses on an allowlist: require(allow[_from] == true);. At deployment only the deployer is on that list. Selling through PancakeSwap's router uses transferFrom to pull tokens from the seller, so every ordinary sell reverts, while buys succeed because the pool pays out with the unrestricted transfer.
The allowlist is controlled by addAllow, whose onlyOwner check is hard-coded to one address, 0xf7E1F5a3…432982, rather than the stored owner. De.Fi's REKT database lists SmartFinance as an exit scam / honeypot dated 2021-04-27, the day the contract was deployed.
How it happened
- The constructor gives the deployer the whole supply and puts only the deployer on the allowlist:
balances[msg.sender] = totalSupply;andallow[msg.sender] = true;. transferFromrequiresallow[_from] == true. The deployer is allowed, so it can use the router'stransferFromto add liquidity to the PancakeSwap pool.- A buy succeeds because the pool sends SMART to the buyer through
transfer, which checks only the balance and a non-zero recipient. - A sell through the router calls
transferFrom(seller, pair, amount). The seller is not on the allowlist, so the call reverts and the swap fails. Selling would need a manualtransferinto the pair followed by a direct call to the pair'sswap, which the standard router flow does not do. - Only the hard-coded address in
modifier onlyOwner() {require(msg.sender == address(0xf7E1F5a3B02178BAFBAE0c6C080622669c432982));_;}can change the list throughaddAllow.transferOwnershipchanges the storedownerbut not that check, and there is no renounce function, so this power cannot be given up. - Because the deployer can sell and remove liquidity while other holders cannot use the router to sell, BNB paid in by buyers can end up with the deployer. The sources reviewed do not show whether or when that happened.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
