1 Million Token Honeypot
What happened
De.Fi's REKT database lists the 1 Million Token (1MT) on BNB Smart Chain as an Exit Scam/Honeypot, stating that the contract owner could disable the transfer function and so restrict users from selling. In the verified code at 0xcec172c9…afdd42 the trap is in _approve: it stores the requested allowance only when the owner is one hard-coded address and writes 0 for everyone else. Since transferFrom subtracts the transferred amount from that allowance, any spender-based move of a holder's tokens, such as a router sell, reverts, while plain transfer between wallets still works.
How it happened
- The constructor sets the name
1 Million Token, symbol1MT, 3 decimals and a supply of 1000000000 raw units, all credited to the deployer. _approveis rewritten so the allowance depends on who the token owner is:if (owner == address(0x41ADC9087E520190ac47f9aA6433d42A408488b5)) { _allowances[owner][spender] = amount; ... } else { _allowances[owner][spender] = 0; emit Approval(owner, spender, 0); }. That address matches the deployer recorded for the deployment transaction 0x267096de…373136.- A holder who calls
approve(orincreaseAllowance) therefore succeeds and emits anApprovalevent, but the stored allowance is 0. transferFromruns_transfer(sender, recipient, amount)and then_approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). With a stored allowance of 0 and anyamount > 0,subreverts and the whole call, including the balance change, is undone. A DEX router pulls tokens withtransferFrom, so non-exempt holders cannot sell through it.- The hard-coded address's own approvals are stored normally, so that address can approve and swap. Ordinary
transferbetween wallets is not affected. - The contract also has
mint(uint256 amount)restricted toonlyOwner, crediting the caller.renounceOwnershipexists but would not change the hard-coded_approveexemption.
This describes what the code allows. The Crypto T3ddy Bear blog post describes the same technique with a different token address; no transaction in the evidence shows how 1MT holders or liquidity providers were affected.
Protocol details
Evidence
- report @Token_Sniffer incident report twitter.com
- report De.Fi REKT database listing (token_name 1MT, Exit Scam/Honeypot, 2021-05-06) twitter.com
- address BscScan verified source, 1 Million Token 0xcec172c986ee617e8ad9df7d92faa166c8afdd42 bscscan.com
- analysis Sourcify copy, 1 Million Token repo.sourcify.dev
- analysis Scam explained: BSC NoApproval (Crypto T3ddy Bear blog) cryptot3ddybear.gitlab.io
Build your security review skills
Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.