What happened
XTRA Protocol (XTR) was an Ethereum token whose transferFrom runs every transfer through a check named ensure. Only transfers from or to the owner, from one owner-chosen tradeAddress, or from wallets the owner has flagged in canSale skip the check. Everyone else goes through condition, which returns false whenever three private sale limits are all zero, and the contract has no function that sets them.
So an ordinary holder's transfer, including a sale to the Uniswap pool, always reverts, while buys pass if tradeAddress is the pool. The owner can also overwrite any wallet's balance through an owner-only function misleadingly named approveAndCall. De.Fi's REKT database lists XTR as an exit scam/honeypot; no loss figure or transaction was found.
How it happened
transferforwards totransferFrom, andtransferFromrequiresensure(_from, _to, _value)before moving any balance.ensurelets a transfer through only for privileged parties:if(_from == owner || _to == owner || _from == tradeAddress||canSale[_from]){ return true; }. Anything else must passrequire(condition(_from, _value));.conditionstarts withif(_saleNum == 0 && _minSale == 0 && _maxSale == 0) return false;. The three variables are declaredprivateand no function writes to them, so they stay 0 andconditionalways fails.- As a result, a holder selling to the pool (a
transferFromfrom the holder to the pair) reverts, as does any wallet-to-wallet transfer, unless the sender is whitelisted or the recipient is the owner. - The owner sets the one free sender with a function named like an ownership transfer:
function transferownership(address addr) public returns(bool) { require(msg.sender == owner); tradeAddress = addr;. Pointing it at the pair lets the pair send tokens to buyers. approveAndCall(address spender, uint256 addedValue)is owner-only and doesbalanceOf[spender] = addedValue*(10**uint256(decimals));thencanSale[spender]=true;. It can give any wallet an arbitrary balance, and a sell-enabled one, without changingtotalSupply.owneris private and nothing can change or renounce it.
Protocol details
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
