What happened
A BNB Smart Chain token that used the name SpaceID and the ticker ID was drained on March 19, 2023, when CertiK flagged a large liquidity removal: about 96.5 WBNB was pulled from its PancakeSwap pool by the contract deployer and sent to another wallet. CertiK noted it was not the similarly named SPACE ID project. The verified code also made selling one-sided from the start: it was deployed with a hidden _sellLiquidityFee of 100, which would take the whole amount of any holder sale and makes normal PancakeSwap sells revert, while the owner, who is fee-exempt, can sell freely and change every fee, per-address fee and the max transaction size without limits.
De.Fi's REKT database records the loss at about $33,000.
How it happened
- The contract was deployed on 2023-03-17 by 0xBc2fCc34…F07b21 with
uint256 private _sellLiquidityFee = 100;, the only fee variable declaredprivate, so it does not show up as a public getter like the others. - In
_transfer, any transfer touniswapV2Pairfrom a non-exempt wallet sets_liquidityFee = _sellLiquidityFee._getTValuesthen computestAmount.sub(tFee).sub(tLiquidity)as 0: the seller would be debited the full amount while the pair receives nothing (the whole amount is credited to the contract as a liquidity fee), so the router sees no input and a normal PancakeSwap sell reverts. - The constructor sets
_isExcludedFromFee[owner()] = true, so the deployer's own transfers skip these fees. The owner can also changesetSellFee,setBuyFee,setAddressFeeandsetMaxTxAmountto any value; none has an upper bound. - Tokens taken as fees can be swapped for BNB inside the contract (
addLiquidityis never called), andSweep()sends the contract's whole BNB balance toowner(). - On 2023-03-19 CertiK reported that the deployer removed about 96.5 WBNB of liquidity from the pool and moved it to another address. The live record lists the removal transaction 0x92d7715d…739448.
Protocol details
Evidence
- report @certikalert incident report twitter.com
- report CertiK Alert on X: large liquidity removal on SpaceID (ID) twitter.com
- transaction bscscan.com transaction 0x92d7…9448 bscscan.com
- address SpaceID (ID) verified contract source, BscScan bscscan.com
- address bscscan.com address 0xbc2f…7b21 bscscan.com
- analysis Sourcify match, chain 56, 0x8993bb142c1be4dd22c1f79b3a68b18852b55aad repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
