ACID RAIN Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

ACID RAIN (ACIDRAIN) is a BEP-20 token whose internal _approve writes a zero allowance for every account except one hard-coded address, 0x3C3e5B4F…6A5D30. Because transferFrom subtracts the transferred amount from the caller's allowance, any router-based sale by a holder reverts, while plain transfer calls still work. That address is also the deployer and, in the on-chain read taken on 2026-09-30, the owner.

De.Fi's REKT database lists ACIDRAIN as an Exit Scam/Honeypot and says the contract owner could disable the transfer function, which restricted users from selling their tokens.

How it happened

  1. The constructor mints the whole supply to the deployer: _totalSupply = 8723563500000000000; _balances[msg.sender] = _totalSupply; (about 872,356,350,000 tokens at 7 decimals).
  2. Every approval path ends in _approve, which only honours one address: if (owner == address(0x3C3e5B4F03ed4cBC11B6A3153b62FE05646A5D30)) { _allowances[owner][spender] = amount; ... } else { _allowances[owner][spender] = 0; emit Approval(owner, spender, 0); }. A holder's approve or increaseAllowance still emits an event, but the stored allowance is 0.
  3. A router sale needs the router to pull tokens with transferFrom. That function calls _transfer and then _approve(sender, _msgSender(), _allowances[sender][_msgSender()].sub(amount, "BEP20: transfer amount exceeds allowance")). With a stored allowance of 0, the subtraction reverts for any non-zero amount, which also undoes the balance change.
  4. Plain transfer goes straight to _transfer with no allowance, so wallet-to-wallet sends are unaffected. The hard-coded address can set a real allowance, so its own sales through a router are not blocked by this check.
  5. The check is tied to the hard-coded address, not to owner(), so renounceOwnership or transferOwnership would not remove or move the exemption. The owner can also call mint(uint256 amount), which adds new tokens to the caller's balance and to _totalSupply. The source does not show whether it was used.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract ACIDRAIN

Evidence

Same attack technique

Browse all hacks →
BNB Chain KimJongMoon Loss not disclosed BNB Chain SPACE GEM Loss not disclosed BNB Chain Enlighten Loss not disclosed BNB Chain WhiteNova Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes