What happened
Zodiac Credit (ZODC) was a BNB Smart Chain token whose transfer function lets the deployer decide who may sell. The contract flags wallets so their sells revert with a fake "Block is busy, please try again" error. Every buyer who paid a gas price above an owner-set threshold is flagged automatically, and the owner can flag any address or every recorded buyer at once.
A hidden _root address keeps admin rights even after ownership is handed to the dead address. On 2023-02-06, the day the token was deployed, CertiK detected the deployer removing about 101.7 WBNB of liquidity and sending it to another wallet. De.Fi lists the loss as about $33K.
How it happened
- The constructor mints the whole supply to the deployer and stores it as the contract's private
_owner. Transfers to or from that address skip every check:if(_owner!=from && _owner!=to && from!=_airTokenAddr){. onlyOwneraccepts a second hidden admin:require(owner() == _msgSender() || _root ==_msgSender(), ...)._rootis set to the deployer and nothing can change it.owner()now returns 0x...dEaD, yet the deployer can still call every admin function.- Any holder flagged in
isStatuscannot sell to the pair:if(to==_swap){ if(isStatus[from]){require(false,"Block is busy, please try again");} }. - Flags are set in three ways. Buys are flagged automatically when
tx.gasprice.mul(100)exceeds the owner-set_defaultPrice(if(from==_swap &&_currprice>_defaultPrice){isStatus[to]=true;}).AirDropGift(user)flags a single address.Bonous()flags every buyer recorded inhaveToken. DepositTransfer()setstradeStatus=true, after which every non-owner transfer not coming from the pair reverts:if(tradeStatus && from!=_swap){require(false,"Block is busy, please try again");}. Wallet-to-wallet transfers by holders always revert, because the code flags the sender inairtokenlistand then reverts on that flag.- The listed outcome: CertiK's Skynet alert reported that the deployer removed about 101.7 WBNB of liquidity and moved it to an EOA beginning 0xDc1. De.Fi links the removal transaction 0x0054d2be…4710a9 from deployer 0xb0b86e33…c19ec7, and says the deployer also sold a large amount of ZODC, dropping the price by about 90%.
Protocol details
Evidence
- report @CertiKAlert incident report twitter.com
- report CertiK Alert on X: #CertiKSkynetAlert large liquidity removal on Zodiac Credit (ZODC) twitter.com
- transaction bscscan.com transaction 0x0054…10a9 bscscan.com
- address Zodiac Credit (ZODC) contract source, BscScan verified code bscscan.com
- address bscscan.com address 0xb0b8…9ec7 bscscan.com
- analysis Sourcify repository: chain 56, 0x436f510a72f7972996b07dC2edeafa26308539e7 (ZODC.sol) repo.sourcify.dev
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.
