What happened
Stability Protocol (STB) is a BNB Smart Chain token with an owner-switchable sell tax that rounds to 100%. When _feeEnabled is true, any transfer into the liquidity pair from an ordinary holder has its balance debited in full, but the pair is credited only the amount left over after a fee computed as mul(div(amount, 100), 100), which is the amount rounded down to a multiple of 100 base units. Transfers out of the pair (buys) and transfers from the owner or the router are not taxed.
setFeeEnabled is owner-only and the flag starts false. De.Fi's REKT database lists STB as an exit scam / honeypot where the contract owner could disable the transfer function, which restricted users in selling their tokens.
How it happened
- The constructor sets
_feeEnabled = false, so early transfers and sells behave normally. - The owner can call
setFeeEnabled(bool feeEnabled), guarded byrequire(_owner == msg.sender), to switch the fee on at any time. The code has norenounceOwnershipor fee cap. - In
_transfer, the sender's balance is reduced by the full amount first:_balances[from] = sub(_balances[from], amount);. - If
_feeEnabled && to == uniswapV2Pair && from != address(uniswapV2Router) && from != _owner && from != address(this), the fee isuint256 fee = mul(div(amount, 100), 100);. Integer division makes thisamount - (amount % 100), so the fee is almost the whole amount. - The pair is credited only
sub(amount, fee), which isamount % 100base units (at most 99, with 9 decimals). The fee is not credited to any balance;_totalSupply = sub(_totalSupply, fee)reduces the supply counter. - A holder selling into the pair therefore delivers almost no tokens to it, so a router swap cannot pay out for the amount sold. Transfers from the pair (buys) take the untaxed
elsebranch, and sells below 100 base units pay no fee.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
