What happened
UNITYtoken (symbol UNI, BNB Chain contract 0xd813127f…74f505) checks every transfer against an owner-controlled list of flagged recipients. When the recipient is flagged in PanCakeSwapReciever, calculateFeesBeforeSend reverts with "Error: Can not sell this token". A sell through a router sends the holder's tokens to the trading pair, so flagging the pair makes every sell revert, while buys, which send tokens out of the pair, are unaffected.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot, stating that the contract owner could disable the transfer function, which restricted users in selling their tokens; no flagging transaction, pool address or loss figure was opened to confirm what happened on-chain.
How it happened
- The constructor mints 25,000,000 tokens (
_transferTO(msg.sender, 25000000e18)) to the deployer, who is also theOwnableowner. - The owner can mark any address as a blocked recipient with
function setPanCakeSwapReciever(address _recipient, bool _feeless) public onlyOwner, which writesPanCakeSwapReciever[_recipient] = _feeless;. The mapping is empty by default, so nothing is blocked until it is set. - Every transfer path ends in
_transfer, which callscalculateFeesBeforeSend(sender, recipient, amount). That function containsif(PanCakeSwapReciever[recipient]){ revert("Error: Can not sell this token"); }, so any transfer whose recipient is flagged reverts and the balance debit on the line above it is rolled back. - A router sell calls
transferFrom(holder, pair, amount), so the recipient is the pool. If the pool address is flagged, the sell reverts for every holder; the check looks only at the recipient, so the sender, the owner included, gets no exemption. A purchase moves tokens from the pool to the buyer, whose address is not flagged, so buying still works. renounceWhitelist()only setscanWhitelist = false, andcanWhitelistis checked bysetFeelessSenderandsetFeelessReciever, not bysetPanCakeSwapReciever. The flag therefore stays settable, and clearable by passingfalse, until the owner callsrenounceOwnership(), which would freeze its current state. The source does not show whether the pool was flagged or when.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
