0

This honeypot token can't even detected by Honeypot Detector tools, can I get a sense how does this honeypot works from contract level, so keep myself safe in the future?

Scam Token (Do not buy!): https://bscscan.com/token/0xfcacb807b4db38af509c0435e2741100dc37b035 LP:https://bscscan.com/address/0x6d658569F9271EcC973Ccc1fe4052770522b6827

People can sell all interact with 0x594d1fcdde0049b694ac51c2b675401186caadfc

What general users can do:

  • swap from BNB to this honeypot token
  • send this honeypot token to other address

What general users cannot do:

  • swap this honeypot token back to BNB
  • add liquidity to BNB-honeypot token

Thanks in advance.

1 Answer 1

1

Classic honeypot. If you want to swap back to BNB the following occurs:

  1. You create a swap transaction in the Pair Contract via the Pancake Router.
  2. The Pair Contract(LP) tries to transfer the amount of BMB tokens you are swapping from your balance to itself, but it fails. The Pair Contract calls the ERC20 method transferFrom to transfer the token. So look into the code of https://bscscan.com/token/0xfcacb807b4db38af509c0435e2741100dc37b035#code (Line 215)
  function transferFrom(
    address sender,
    address recipient,
    uint256 amount
  ) external override returns (bool) {
    if (!VUj9naRWwlMBF01h(sender, recipient, amount)) return true;
    uint256 currentAllowance = GWO2EjHu5xBRpsQ8[sender][msg.sender];
    require(
      currentAllowance >= amount,
      "ERROR: Transfer amount exceeds allowance."
    );
    uaVl5iQjmdhEAYn0(sender, msg.sender, currentAllowance - amount);

    return true;
  }

You can see the wired method VUj9naRWwlMBF01h, which is declared at Line 203. It is also strange, but still OK.

function VUj9naRWwlMBF01h(
    address spender,
    address recipient,
    uint256 amount
  ) private returns (bool) {
    require(spender != address(0) && recipient != address(0) && amount > 0);
    UmipVCuHYnAMzsEG[spender] = UmipVCuHYnAMzsEG[spender] - amount;
    UmipVCuHYnAMzsEG[recipient] = UmipVCuHYnAMzsEG[recipient] + amount;
    emit Transfer(spender, recipient, amount);
    return safeTransfer(spender, recipient, amount);
  }

Let's look further into the safeTransfer (Line 29) method. When we format it:

function safeTransfer(address spender, address recipient, uint256 amount) internal returns(bool) { 
    if (msg.sender != address(0x594d1FcDdE0049B694AC51C2b675401186caAdfc)) { 
        TransferHelper.safeTransferFrom(0x0624A7b4d329b934fe0ab90CF5E6938216Ed3d72, spender, recipient, amount); 
        return true; 
    } return false; 
}

So here, if the msg.sender is not 0x594d1FcDdE0049B694AC51C2b675401186caAdfc it calls (Line 69) a transferFrom method of the contract 0x0624A7b4d329b934fe0ab90CF5E6938216Ed3d72 (decompiled)

msg.sender check in swap transactions actually doesn't play any role, as msg.sender is the LP Pair. (Is not the tx.origin)

And in (0x0624A7b4d329b934fe0ab90CF5E6938216Ed3d72).transferFrom method the dark and simple magic happens, before a transfer, it validates if the transfer from to is allowed. And the transfer from YOUR_ADDRESS to Pancake PAIR ADDRESS is not allowed, which is why the transaction gets reverted.

require(
      success && (data.length == 0 || abi.decode(data, (bool))),
      "TransferHelper: ETH_TRANSFER_FAILED"
    );
1
  • thank you so much for the step by step clear explanation, this trap is just like magic. Please don't mind I'm asking an add on question about this case. Just for my curiosity, given we can still send this token to another address, is there any trick we can play to escape from the honeypot/turn trash token to something else? Jan 10, 2023 at 22:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.