What happened
VanillaUnicorn is a token on BNB Smart Chain whose transferFrom only works when the token holder's address is on an allow list: require(allow[_from] == true);. Router-based sells call transferFrom with the holder as _from, so they revert for any holder who has not been allowed. Only the constructor's caller starts on the list, and the list can be changed only through addAllow, which the onlyOwner modifier restricts to one hard-coded address that differs from the deployer.
De.Fi's REKT database lists the token as an Exit Scam/Honeypot in which the owner could restrict holders from selling. The same hard-coded address can also call mint, which overwrites any address's balance.
How it happened
- The constructor sets
balances[msg.sender] = totalSupply;andallow[msg.sender] = true;, so only the deployer starts on the allow list. transferFrom(_from, _to, _value)containsrequire(allow[_from] == true);. When a holder sells through a router, the router callstransferFromwith the holder as_from, so the call reverts unless the holder is on the list.- Buys and plain transfers are not affected by that line.
transferhas no allow-list check: it only requires_to != address(0)and a sufficient balance, and a buy moves tokens out of the pair to the buyer throughtransfer. modifier onlyOwner() {require(msg.sender == address(1080614020421183795110940285280029773222128095634));_;}hard-codes the controlling address as 0xbd486897…439192, not the deployer 0x16506D21…fF5D37. Only that address can calladdAllow(address holder, bool allowApprove)to add or remove holders,transferOwnership, ormint. Theownerstorage variable set in the constructor is not whatonlyOwnerchecks, and the code has no renounce function. Who controls the hard-coded address is not established.mint(address miner, uint256 _value)runsbalances[miner] = _value;. It sets a balance to any value without changingtotalSupply, so it can raise or zero any address's balance, including a pair's.- What actually happened is not established by the code. The listing says the token was a honeypot; no transaction showing a failed sell, an
addAllowormintcall, or a liquidity withdrawal was opened.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
