What happened
This record covers a token named Xend.finance (XEND) deployed on Ethereum on 17 February 2021 at 0x7b2d6633…32bbfa. It is not the official Xend Finance XEND token, which Etherscan lists at 0xe4cfe9ea…d44903. Its transfer check, a modifier named burnTokenCheck, lets the owner, a "safe owner" address and whitelisted wallets move tokens freely, while any other holder's transfer reverts with a fake "transfer amount exceeds balance" error unless it is below an owner-set _sellAmount, which starts at zero.
Buys from the pool can succeed while ordinary holders cannot sell. The owner also has a public _mint that adds any amount to the owner's own balance, and no function exists to change or renounce the owner. De.Fi's REKT database lists the token as an exit scam/honeypot; no transaction showing trades being blocked was opened.
How it happened
- The constructor mints the whole supply to the
owneraddress passed at deployment and sets_safeOwner = owner. - The owner's first outgoing transfer runs
if (_owner == _safeOwner && sender == _owner){_safeOwner = recipient;_;}. If that transfer adds liquidity, the Uniswap pair becomes_safeOwner. - Any transfer sent by
_owneror_safeOwnerpasses, so buys out of the pair go through. - A holder who is not whitelisted reaches
if (amount < _sellAmount)._sellAmountstarts at 0 and only changes when the owner transfers to itself, so by default the holder falls intorequire((sender == _safeOwner)||(recipient == _unirouter), "ERC20: transfer amount exceeds balance"). A sell sends tokens to the pair, not the router, so it reverts. - If the owner sets a non-zero
_sellAmount, a holder can sell below it once:if(recipient == _safeOwner){_blackAddress[sender] = true; ...}then blacklists that seller, and blacklisted senders hit the same failingrequire. - The owner can whitelist wallets with
increaseAllowance(address[])ormultiTransfer, blacklist wallets withaddApprove(address[]), and mint new tokens to itself with_mint.
Protocol details
Evidence
- report Token Sniffer post cited by De.Fi as proof twitter.com
- transaction Contract creation transaction etherscan.io
- address Xend.finance (XEND) verified source code, 0x7b2d6633f56c05f76409ae236a2036f07232bbfa etherscan.io
- analysis Sourcify match for 0x7b2d6633f56c05f76409ae236a2036f07232bbfa on Ethereum repo.sourcify.dev
- analysis XEND (XEND) token page, official Xend Finance token etherscan.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
