how does this honeypot works on BSC - it allows swapping from BNB but not reverse, can't even add BNB liquidity using it

Question

This honeypot token can't even detected by Honeypot Detector tools, can I get a sense how does this honeypot works from contract level, so keep myself safe in the future?

Scam Token (Do not buy!): https://bscscan.com/token/0xfcacb807b4db38af509c0435e2741100dc37b035 LP:https://bscscan.com/address/0x6d658569F9271EcC973Ccc1fe4052770522b6827

People can sell all interact with 0x594d1fcdde0049b694ac51c2b675401186caadfc

What general users can do:

• swap from BNB to this honeypot token
• send this honeypot token to other address

What general users cannot do:

• swap this honeypot token back to BNB
• add liquidity to BNB-honeypot token

Thanks in advance.

Answer 1

Classic honeypot. If you want to swap back to BNB the following occurs:

1. You create a swap transaction in the Pair Contract via the Pancake Router.
2. The Pair Contract(LP) tries to transfer the amount of BMB tokens you are swapping from your balance to itself, but it fails. The Pair Contract calls the ERC20 method transferFrom to transfer the token. So look into the code of https://bscscan.com/token/0xfcacb807b4db38af509c0435e2741100dc37b035#code (Line 215)

  function transferFrom(
    address sender,
    address recipient,
    uint256 amount
  ) external override returns (bool) {
    if (!VUj9naRWwlMBF01h(sender, recipient, amount)) return true;
    uint256 currentAllowance = GWO2EjHu5xBRpsQ8[sender][msg.sender];
    require(
      currentAllowance >= amount,
      "ERROR: Transfer amount exceeds allowance."
    );
    uaVl5iQjmdhEAYn0(sender, msg.sender, currentAllowance - amount);

    return true;
  }

You can see the wired method VUj9naRWwlMBF01h, which is declared at Line 203. It is also strange, but still OK.

function VUj9naRWwlMBF01h(
    address spender,
    address recipient,
    uint256 amount
  ) private returns (bool) {
    require(spender != address(0) && recipient != address(0) && amount > 0);
    UmipVCuHYnAMzsEG[spender] = UmipVCuHYnAMzsEG[spender] - amount;
    UmipVCuHYnAMzsEG[recipient] = UmipVCuHYnAMzsEG[recipient] + amount;
    emit Transfer(spender, recipient, amount);
    return safeTransfer(spender, recipient, amount);
  }

Let's look further into the safeTransfer (Line 29) method. When we format it:

function safeTransfer(address spender, address recipient, uint256 amount) internal returns(bool) { 
    if (msg.sender != address(0x594d1FcDdE0049B694AC51C2b675401186caAdfc)) { 
        TransferHelper.safeTransferFrom(0x0624A7b4d329b934fe0ab90CF5E6938216Ed3d72, spender, recipient, amount); 
        return true; 
    } return false; 
}

So here, if the msg.sender is not 0x594d1FcDdE0049B694AC51C2b675401186caAdfc it calls (Line 69) a transferFrom method of the contract 0x0624A7b4d329b934fe0ab90CF5E6938216Ed3d72 (decompiled)

msg.sender check in swap transactions actually doesn't play any role, as msg.sender is the LP Pair. (Is not the tx.origin)

And in (0x0624A7b4d329b934fe0ab90CF5E6938216Ed3d72).transferFrom method the dark and simple magic happens, before a transfer, it validates if the transfer from to is allowed. And the transfer from YOUR_ADDRESS to Pancake PAIR ADDRESS is not allowed, which is why the transaction gets reverted.

require(
      success && (data.length == 0 || abi.decode(data, (bool))),
      "TransferHelper: ETH_TRANSFER_FAILED"
    );