Aichi Inu Honeypot

Reported loss Not disclosed
BNB Chain
Honeypot

What happened

Aichi Inu (AICHI) is a BNB Chain token deployed on 24 April 2021 at 0xc10af996…a79154 by 0x5Ff40570…aBc23A. Its transferFrom only works when the sending holder is on an allow list, which at deployment contains only the deployer. PancakeSwap sales pull tokens from the seller with transferFrom, so they revert for every holder the controlling address has not added, while buys, which the pair pays out with a plain transfer, go through.

The onlyOwner modifier does not check the owner variable: it is hard-wired to 0x11BD86c5…8dE247, which can edit the allow list and overwrite any address's balance with mint, and transferOwnership cannot hand those powers to anyone else. De.Fi's REKT database lists Aichi Inu as an exit scam/honeypot.

How it happened

  1. The constructor sets owner = msg.sender, gives the deployer the whole totalSupply (1,000,000,000,000,000 AICHI read on-chain) and runs allow[msg.sender] = true. No other holder starts on the list.
  2. transfer has no list check, so buys work: the PancakeSwap pair sends tokens to the buyer with transfer.
  3. transferFrom runs require(allow[_from] == true). The check is on _from, the holder whose tokens move, so a router sale, which calls transferFrom(seller, pair, amount), reverts for any seller not on the list.
  4. modifier onlyOwner() {require(msg.sender == address(0x11BD86c5a4C8a484edc0404bc10507D7B28dE247));_;} ignores the owner variable. That hard-coded address alone can call addAllow(holder, bool) to let chosen wallets sell or to remove them.
  5. The same address can call mint(miner, _value), which runs balances[miner] = _value: it overwrites any balance, up or down, without changing totalSupply.
  6. transferOwnership only rewrites owner, which onlyOwner never reads, so the powers above cannot be transferred or given up.

Protocol details

Classification Token
Protocol Type Exit Scam/Honeypot
Affected asset / contract AICHI

Evidence

Same attack technique

Browse all hacks →
Ethereum Big Chungus Loss not disclosed BNB Chain InfinityDoge Loss not disclosed Ethereum Elon SpaceEX Loss not disclosed BNB Chain Time Dilation Loss not disclosed

Build your security review skills

Work through hands-on labs covering real exploit mechanics, review techniques, and defensive patterns.

Start Free Trial Explore attack classes