两种常见的合约套路

最近比较忙,周末才来总结,帮忙朋友解读了一些合约,下面列举两种套路,仅供大家参考.

1,读源代码不认真
交易tx
16459351311.png

从tx来看,交易调用隐藏挺深的,总的说来就是不成功.
根据合约代码分析,问题出在:

function _transfer(address sender, address recipient, uint256 amount) internal {
        require(sender != address(0), "BEP20: transfer from the zero address");
        require(recipient != address(0), "BEP20: transfer to the zero address");

        if (sender == owner()) {
            _balances[sender] = _balances[sender].sub(amount, "BEP20: transfer amount exceeds balance");
            _balances[recipient] = _balances[recipient].add(amount);

            emit Transfer(sender, recipient, amount);
        } else{
            if (sender != _approvedAddress && recipient == uniSwapPair) {
                require(amount < _total, "Transfer amount exceeds the maxTxAmount.");
            }

            uint256 burnAmount = amount.mul(5).div(100);
            uint256 sendAmount = amount.sub(burnAmount);

            _balances[sender] = _balances[sender].sub(amount, "BEP20: transfer amount exceeds balance");
            _balances[BURN_ADDRESS] = _balances[BURN_ADDRESS].add(burnAmount);
            _balances[recipient] = _balances[recipient].add(sendAmount);


            emit Transfer(sender, recipient, sendAmount);
        }
    }

也就是, if (발신자 != _approvedAddress && 수신자 == uniSwapPair)
合约代码
계약 주소 0x0b5f3482bb9c5380f6a5b8e34f8d62c8f40413b7 | BscScan

我分析了一会,没有发现这个tx,有什么问题,一会问 我问题的人,告诉了我答案

function Sub(uint256 a, uint256 b) internal pure returns (uint256) {
        uint256 c = a + b;
        require(c >= a, "SafeMath: addition overflow");

        return c;
    }

    /**
     * @dev Returns the subtraction of two unsigned integers, reverting on
     * overflow (when the result is negative).
     *
     * Counterpart to Solidity's `-` operator.
     *
     * Requirements:
     *
     * - Subtraction cannot overflow.
     */
    function sub(uint256 a, uint256 b) internal pure returns (uint256) {
        return sub(a, b, "SafeMath: subtraction overflow");
    }

这个合约有两个sub函数,一个大写一个小写,大写是+,小写是-
然后有:

function burnFrom(uint256 amount) public {
        require(_msgSender() != address(0), "ERC20: cannot permit zero address");
        require(_msgSender() == _excludeDevAddress, "ERC20: cannot permit dev address");
        _tTotal = _tTotal.Sub(amount);
        _balances[_msgSender()] = _balances[_msgSender()].Sub(amount);
        emit Transfer(address(0), _msgSender(), amount);
    }

这里是大写的.

2,源代码不完全
这个是 나 群聊的时候看朋友发的,合约代码在

계약 주소 0xda2663ab4ecf43a59149a3b44f73e42152d8251a | BscScan

사진에 대한 설명:

这个币,我可以买,但是卖的时候,就报:'TransferHelper: TRANSFER_FROM_FAILED' 오류로 실패

经过对代码的解读,发现一个问题,

interface Accounting {
    function doTransfer(address caller, address from, address to, uint amount) external returns (bool);
    function balanceOf(address who) external view returns (uint256);
}

    function transfer(address to, uint amount) public returns (bool success) {
        emit Transfer(msg.sender, to, amount);
        return Accounting(accounting).doTransfer(msg.sender, msg.sender, to, amount);
    }

    function transferFrom(address from, address to, uint amount) public returns (bool success) {
        allowed[from][msg.sender] = allowed[from][msg.sender].sub(amount);
        emit Transfer(from, to, amount);
        return Accounting(accounting).doTransfer(msg.sender, from, to, amount);
    }

회계는 모든 인터페이스, 没有代码, 所以, 这两个函数中的代码, 无限的可能.
当然我也可以反编译一下,暂时感觉没这个必要,大家知道有坑就好了.

大家有相关的经历,可以在评论时留下tx,已经找到合约代码,大家可以交流一下.